{"action":"created","issue":{"url":"https://api.github.com/repos/habitat-sh/core/issues/46","repository_url":"https://api.github.com/repos/habitat-sh/core","labels_url":"https://api.github.com/repos/habitat-sh/core/issues/46/labels{/name}","comments_url":"https://api.github.com/repos/habitat-sh/core/issues/46/comments","events_url":"https://api.github.com/repos/habitat-sh/core/issues/46/events","html_url":"https://github.com/habitat-sh/core/pull/46","id":345397567,"node_id":"MDExOlB1bGxSZXF1ZXN0MjA0NTYzNTY2","number":46,"title":"Make plan parsing a little more robust.","user":{"login":"raskchanky","id":947,"node_id":"MDQ6VXNlcjk0Nw==","avatar_url":"https://avatars1.githubusercontent.com/u/947?v=4","gravatar_id":"","url":"https://api.github.com/users/raskchanky","html_url":"https://github.com/raskchanky","followers_url":"https://api.github.com/users/raskchanky/followers","following_url":"https://api.github.com/users/raskchanky/following{/other_user}","gists_url":"https://api.github.com/users/raskchanky/gists{/gist_id}","starred_url":"https://api.github.com/users/raskchanky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/raskchanky/subscriptions","organizations_url":"https://api.github.com/users/raskchanky/orgs","repos_url":"https://api.github.com/users/raskchanky/repos","events_url":"https://api.github.com/users/raskchanky/events{/privacy}","received_events_url":"https://api.github.com/users/raskchanky/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-07-27T23:58:21Z","updated_at":"2018-07-30T14:35:45Z","closed_at":null,"author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/habitat-sh/core/pulls/46","html_url":"https://github.com/habitat-sh/core/pull/46","diff_url":"https://github.com/habitat-sh/core/pull/46.diff","patch_url":"https://github.com/habitat-sh/core/pull/46.patch"},"body":"![](https://media.giphy.com/media/3NmDqcqbZAUCs/giphy.gif)\r\n\r\nCloses https://github.com/habitat-sh/builder/issues/368\r\nSigned-off-by: Josh Black <raskchanky@gmail.com>"},"comment":{"url":"https://api.github.com/repos/habitat-sh/core/issues/comments/408885676","html_url":"https://github.com/habitat-sh/core/pull/46#issuecomment-408885676","issue_url":"https://api.github.com/repos/habitat-sh/core/issues/46","id":408885676,"node_id":"MDEyOklzc3VlQ29tbWVudDQwODg4NTY3Ng==","user":{"login":"christophermaier","id":207178,"node_id":"MDQ6VXNlcjIwNzE3OA==","avatar_url":"https://avatars2.githubusercontent.com/u/207178?v=4","gravatar_id":"","url":"https://api.github.com/users/christophermaier","html_url":"https://github.com/christophermaier","followers_url":"https://api.github.com/users/christophermaier/followers","following_url":"https://api.github.com/users/christophermaier/following{/other_user}","gists_url":"https://api.github.com/users/christophermaier/gists{/gist_id}","starred_url":"https://api.github.com/users/christophermaier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/christophermaier/subscriptions","organizations_url":"https://api.github.com/users/christophermaier/orgs","repos_url":"https://api.github.com/users/christophermaier/repos","events_url":"https://api.github.com/users/christophermaier/events{/privacy}","received_events_url":"https://api.github.com/users/christophermaier/received_events","type":"User","site_admin":false},"created_at":"2018-07-30T14:35:45Z","updated_at":"2018-07-30T14:35:45Z","author_association":"CONTRIBUTOR","body":"@baumanj I think that opens us up to remote code execution:\r\n\r\n`plan.sh`:\r\n```bash\r\necho \"HACKED\"\r\npkg_name=\"my_package\"\r\n# etc...\r\n```\r\n\r\n`test.sh`: \r\n``` bash\r\n#!/bin/bash\r\necho $pkg_name\r\n```\r\nExecution: \r\n```bash\r\ncat plan.sh test.sh | bash\r\nHACKED\r\nmy_package\r\n```\r\n"}}
{"actor":{"display_login":"christophermaier"}}