Re: [BUG][SECURITY] ob-sqlite header args allows execution of arbitrary shell commands

[Max Nikulin]

On 13/08/2023 14:52, Ihor Radchenko wrote:
> +         (when separator (format "-separator %s" separator))

It should be escaped as a whole. It seems sqlite3 command line arguments 
parser does not support -separator=| variant, so two words should be 
quoted separately. Try :separator |

sqlite3: Error: unknown option: -separator |
Use -help for a list of options.
[ Babel evaluation exited with code 1 ]