Re: [PATCH 2/2] kconfig: Deny command substitution in string values

[Boris Kolpackov]

Richard Weinberger <richard@xxxxxx> writes:

> Yes. auto.conf is .config post processed.
> This is exactly where my mitigation takes place.

No, sym_escape_string_value() is called by conf_write_symbol()
which in turn is called from conf_write() and conf_write_defconfig()
(used to write .config files) besides conf_write_autoconf() (used to
write auto.conf).