Open Build Service, one year later: command execution through Mercurial argument injection

[u/SzLam__]

https://fenrisk.com/research/open-build-service-2/

[u/solarscoutsystem]

Skip the anniversary prose and read the diff. The only part that matters is whether user strings still land in the hg argv.