<p>In this situation, <code>trace_name</code> can be trivially checked as legitimate, but this removes any lingering risks from interpolating into a command line instead of passing parameters explicitly.</p>
<p>Refs <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="445851912" data-permission-text="Title is private" data-url="https://github.com/openstreetmap/openstreetmap-website/issues/2229" data-hovercard-type="pull_request" data-hovercard-url="/openstreetmap/openstreetmap-website/pull/2229/hovercard" href="https://github.com/openstreetmap/openstreetmap-website/pull/2229">#2229</a></p>

<hr>

<h4>You can view, comment on, or merge this pull request online at:</h4>
<p>  <a href='https://github.com/openstreetmap/openstreetmap-website/pull/2597'>https://github.com/openstreetmap/openstreetmap-website/pull/2597</a></p>

<h4>Commit Summary</h4>
<ul>
  <li>Use Open3.capture2 instead of backticks, to avoid command line injection risks</li>
</ul>

<h4>File Changes</h4>
<ul>
  <li>
    <strong>M</strong>
    <a href="https://github.com/openstreetmap/openstreetmap-website/pull/2597/files#diff-c897207d3a4aad061fcfde390e878cb5">app/models/trace.rb</a>
    (7)
  </li>
</ul>

<h4>Patch Links:</h4>
<ul>
  <li><a href='https://github.com/openstreetmap/openstreetmap-website/pull/2597.patch'>https://github.com/openstreetmap/openstreetmap-website/pull/2597.patch</a></li>
  <li><a href='https://github.com/openstreetmap/openstreetmap-website/pull/2597.diff'>https://github.com/openstreetmap/openstreetmap-website/pull/2597.diff</a></li>
</ul>

<p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">—<br />You are receiving this because you are subscribed to this thread.<br />Reply to this email directly, <a href="https://github.com/openstreetmap/openstreetmap-website/pull/2597">view it on GitHub</a>, or <a href="https://github.com/notifications/unsubscribe-auth/AAK2OLMUHN62VEQ3SCKV2V3RN3IO7ANCNFSM4MOCURNQ">unsubscribe</a>.<img src="https://github.com/notifications/beacon/AAK2OLOOCXPOOAPAEBQOMEDRN3IO7A5CNFSM4MOCURN2YY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4JAKW7CA.gif" height="1" width="1" alt="" /></p>
<script type="application/ld+json">[
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"potentialAction": {
"@type": "ViewAction",
"target": "https://github.com/openstreetmap/openstreetmap-website/pull/2597",
"url": "https://github.com/openstreetmap/openstreetmap-website/pull/2597",
"name": "View Pull Request"
},
"description": "View this Pull Request on GitHub",
"publisher": {
"@type": "Organization",
"name": "GitHub",
"url": "https://github.com"
}
}
]</script>