On Thu, 13 May 2021 12:58 +0900, Junio C Hamano wrote:
In short, it is far from sufficient to just "$concatenate @variables"
to form a single string. $sendmail_cmd should be left as-is (after
all, we do want the shell to split it at $IFS whitespace into tokens),
but each element of @sendmail_parameters should be protected from
the shell (both word splitting and $interpolation rules). Perhaps
something along the lines of this instead?
exec ("sh", "-c", "$sendmail_cmd \"\$\@\"", "-", @sendmail_parameters);
Does this pose a problem for platforms such as Windows that don't have a
'sh' (not sure if there are any others)? Is git-send-email meant to
support Windows?
