Merge branch 'master' into nightly

CHANGELOG.md

@@ -18,6 +18,10 @@ Every user-facing change should have an entry in this changelog. Please respect
 
 ## Unreleased
 
+## v14.1.2 (2022-11-02)
+
+- [Security] Fix edx-platform XSS vulnerability on "next" parameter. (by @regisb)
+
 ## v14.1.1 (2022-10-25)
 
 - [Deprecation] Tutor is no longer compatible with Python 3.6. (by @regisb)

tutor/__about__.py

@@ -2,7 +2,7 @@ import os
 
 # Increment this version number to trigger a new release. See
 # docs/tutor.html#versioning for information on the versioning scheme.
-__version__ = "14.1.1"
+__version__ = "14.1.2"
 
 # The version suffix will be appended to the actual version, separated by a
 # dash. Use this suffix to differentiate between the actual released version and

tutor/utils.py

@@ -235,7 +235,7 @@ def _shlex_join(*split_command: str) -> str:
 
 
 def check_output(*command: str) -> bytes:
-    literal_command = " ".join(command)
+    literal_command = _shlex_join(*command)
     click.echo(fmt.command(literal_command))
     try:
         return subprocess.check_output(command)