summaryrefslogtreecommitdiff
path: root/Build
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2021-03-14 22:19:56 +0000
committerKarl Berry <karl@freefriends.org>2021-03-14 22:19:56 +0000
commitef53dd80b679b0303dc123ce0a6f00e68683355a (patch)
treea716d060d60f74a0af602630c9bf6e0a214e076c /Build
parent0368a640c5ea2aeabc0f31b834e9e32390f4c221 (diff)
escape all shell metacharacters and whitespace
git-svn-id: svn://tug.org/texlive/trunk@58347 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build')
-rw-r--r--Build/source/texk/xdvik/ChangeLog13
-rw-r--r--Build/source/texk/xdvik/string-utils.c24
2 files changed, 30 insertions, 7 deletions
diff --git a/Build/source/texk/xdvik/ChangeLog b/Build/source/texk/xdvik/ChangeLog
index bfb06942ce8..56039658117 100644
--- a/Build/source/texk/xdvik/ChangeLog
+++ b/Build/source/texk/xdvik/ChangeLog
@@ -1,3 +1,16 @@
+2021-03-14 Karl Berry <karl@freefriends.org>
+
+ * string-utils.c (shell_escape_string): escape other shell
+ metacharacters and whitespace.
+
+2021-03-12 Norbert Preining <norbert@preining.info>
+
+ * string-utils.c (shell_escape_string): also escape &.
+
+2021-03-14 Norbert Preining <norbert@preining.info>
+
+ * string-utils.c (shell_escape_string): also escape &.
+
2020-03-02 Karl Berry <karl@freefriends.org>
* main.c (is_good_dvi_file): avoid using strnlen, not present
diff --git a/Build/source/texk/xdvik/string-utils.c b/Build/source/texk/xdvik/string-utils.c
index a09a1b77762..062cd35248f 100644
--- a/Build/source/texk/xdvik/string-utils.c
+++ b/Build/source/texk/xdvik/string-utils.c
@@ -635,10 +635,10 @@ canonicalize_path(const char *path)
return start;
}
-/* Escape all of the following characters in str:
- ` \ ; ( ) &
- making it safe to pass str to a shell. Return result in a newly
- allocated string, which the caller is responsible to free() after use.
+/* Escape shell metacharacters in str, hopefully making it safe to pass
+ str to system(), i.e., /bin/sh -c, without further quoting. Return
+ result in a newly allocated string, which the caller is responsible
+ to free() after use.
*/
char *
shell_escape_string(const char *str)
@@ -651,10 +651,20 @@ shell_escape_string(const char *str)
while (*src_ptr != '\0') {
if (*src_ptr == '\\'
|| *src_ptr == '`'
- || *src_ptr == '('
- || *src_ptr == ')'
+ || *src_ptr == '\''
+ || *src_ptr == '"'
+ || *src_ptr == '(' || *src_ptr == ')'
+ || *src_ptr == '{' || *src_ptr == '}'
+ || *src_ptr == '[' || *src_ptr == ']'
+ || *src_ptr == '<' || *src_ptr == '>'
|| *src_ptr == '&'
- || *src_ptr == ';') {
+ || *src_ptr == '|'
+ || *src_ptr == '!'
+ || *src_ptr == '$'
+ || *src_ptr == '*'
+ || *src_ptr == '?'
+ || *src_ptr == ';'
+ || *src_ptr == ' ' || *src_ptr == '\t' || *src_ptr == '\n') {
#if 0
/* only if not yet escaped? */
&& (src_ptr == str || (src_ptr > str && *(src_ptr - 1) != '\\'))) {