diff options
| author | Taco Hoekwater <taco@elvenkind.com> | 2010-06-04 12:46:37 +0000 |
|---|---|---|
| committer | Taco Hoekwater <taco@elvenkind.com> | 2010-06-04 12:46:37 +0000 |
| commit | 8278ef1ce02ecd369007e4881a3d18fdfdb595fd (patch) | |
| tree | a8fbe47db3981b1848dbf6951622998a2014302b /Build/source/texk | |
| parent | cd4c0d4bada573a57911986a18aadeadd98c957a (diff) | |
allow only absolute command names in restricted mode win32
(from Akira)
git-svn-id: svn://tug.org/texlive/trunk@18718 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk')
| -rw-r--r-- | Build/source/texk/web2c/luatexdir/ChangeLog | 7 | ||||
| -rw-r--r-- | Build/source/texk/web2c/luatexdir/luatex.c | 36 |
2 files changed, 41 insertions, 2 deletions
diff --git a/Build/source/texk/web2c/luatexdir/ChangeLog b/Build/source/texk/web2c/luatexdir/ChangeLog index 6291a21467f..865d96e2b2c 100644 --- a/Build/source/texk/web2c/luatexdir/ChangeLog +++ b/Build/source/texk/web2c/luatexdir/ChangeLog @@ -1,8 +1,13 @@ +2010-06-04 Taco Hoekwater <taco@luatex.org> + * luatex.c (shell_cmd_is_allowed): make sure only commands with + absolute path names are executed on win32 in restricted mode -- + patch from Akira Katuto. + 2010-05-28 Taco Hoekwater <taco@luatex.org> * luamd5/md.5c: bring in a new version from kepler to fix a portability problem with stdint.h. * luafontloader/src/ffdummies.c, lua/texluac.w: guard __attribute__ - usage, which is a GNUC only featire. + usage, which is a GNUC only feature. 2010-05-19 Taco Hoekwater <taco@luatex.org> * printing.w (print_banner, log_banner), luainit.w (lua_initialize): diff --git a/Build/source/texk/web2c/luatexdir/luatex.c b/Build/source/texk/web2c/luatexdir/luatex.c index 7a53581f492..268c8dfddc7 100644 --- a/Build/source/texk/web2c/luatexdir/luatex.c +++ b/Build/source/texk/web2c/luatexdir/luatex.c @@ -15,7 +15,7 @@ #include "luatex_svnversion.h" static const char _svn_version[] = - "$Id: luatex.c 3678 2010-05-06 08:46:53Z taco $ " + "$Id: luatex.c 3714 2010-06-04 12:33:50Z taco $ " "$URL: http://foundry.supelec.fr/svn/luatex/branches/0.60.x/source/texk/web2c/luatexdir/luatex.c $"; #define TeX @@ -33,6 +33,10 @@ const char *engine_name = "luatex"; /* the name of this engine */ #include <kpathsea/variable.h> #include <kpathsea/absolute.h> #include <kpathsea/recorder.h> +#ifdef WIN32 +#include <kpathsea/concatn.h> +#endif + #include <time.h> /* For `struct tm'. */ #if defined (HAVE_SYS_TIME_H) @@ -347,6 +351,36 @@ int shell_cmd_is_allowed(const char **cmd, char **safecmd, char **cmdname) *d++ = QUOTE; } *d = '\0'; +#ifdef WIN32 + { + char *p, *q, *r; + p = *safecmd; + if (!(IS_DIR_SEP (p[0]) && IS_DIR_SEP (p[1])) && + !(p[1] == ':' && IS_DIR_SEP (p[2]))) { + p = (char *) kpse_var_value ("SELFAUTOLOC"); + if (p) { + r = *safecmd; + while (*r && !Isspace(*r)) + r++; + if (*r == '\0') + q = concatn ("\"", p, "/", *safecmd, "\"", NULL); + else { + *r = '\0'; + r++; + while (*r && Isspace(*r)) + r++; + if (*r) + q = concatn ("\"", p, "/", *safecmd, "\" ", r, NULL); + else + q = concatn ("\"", p, "/", *safecmd, "\"", NULL); + } + free (p); + free (*safecmd); + *safecmd = q; + } + } + } +#endif } return allow; |