Escape env value before passing it to system call

11 years ago · 202701c391
parent 11facc3f44
commit 202701c391
1 changed files with 1 additions and 1 deletions
--- a/src/Composer/Command/ConfigCommand.php
+++ b/src/Composer/Command/ConfigCommand.php
@ -132,7 +132,7 @@ EOT
    {
        // Open file in editor
        if ($input->getOption('editor')) {
-            $editor = getenv('EDITOR');
+            $editor = escapeshellcmd(getenv('EDITOR'));
            if (!$editor) {
                if (defined('PHP_WINDOWS_VERSION_BUILD')) {
                    $editor = 'notepad';