summaryrefslogtreecommitdiff
path: root/Build
diff options
context:
space:
mode:
Diffstat (limited to 'Build')
-rw-r--r--Build/source/texk/xdvik/ChangeLog13
-rw-r--r--Build/source/texk/xdvik/string-utils.c24
2 files changed, 30 insertions, 7 deletions
diff --git a/Build/source/texk/xdvik/ChangeLog b/Build/source/texk/xdvik/ChangeLog
index bfb06942ce8..56039658117 100644
--- a/Build/source/texk/xdvik/ChangeLog
+++ b/Build/source/texk/xdvik/ChangeLog
@@ -1,3 +1,16 @@
+2021-03-14 Karl Berry <karl@freefriends.org>
+
+ * string-utils.c (shell_escape_string): escape other shell
+ metacharacters and whitespace.
+
+2021-03-12 Norbert Preining <norbert@preining.info>
+
+ * string-utils.c (shell_escape_string): also escape &.
+
+2021-03-14 Norbert Preining <norbert@preining.info>
+
+ * string-utils.c (shell_escape_string): also escape &.
+
2020-03-02 Karl Berry <karl@freefriends.org>
* main.c (is_good_dvi_file): avoid using strnlen, not present
diff --git a/Build/source/texk/xdvik/string-utils.c b/Build/source/texk/xdvik/string-utils.c
index a09a1b77762..062cd35248f 100644
--- a/Build/source/texk/xdvik/string-utils.c
+++ b/Build/source/texk/xdvik/string-utils.c
@@ -635,10 +635,10 @@ canonicalize_path(const char *path)
return start;
}
-/* Escape all of the following characters in str:
- ` \ ; ( ) &
- making it safe to pass str to a shell. Return result in a newly
- allocated string, which the caller is responsible to free() after use.
+/* Escape shell metacharacters in str, hopefully making it safe to pass
+ str to system(), i.e., /bin/sh -c, without further quoting. Return
+ result in a newly allocated string, which the caller is responsible
+ to free() after use.
*/
char *
shell_escape_string(const char *str)
@@ -651,10 +651,20 @@ shell_escape_string(const char *str)
while (*src_ptr != '\0') {
if (*src_ptr == '\\'
|| *src_ptr == '`'
- || *src_ptr == '('
- || *src_ptr == ')'
+ || *src_ptr == '\''
+ || *src_ptr == '"'
+ || *src_ptr == '(' || *src_ptr == ')'
+ || *src_ptr == '{' || *src_ptr == '}'
+ || *src_ptr == '[' || *src_ptr == ']'
+ || *src_ptr == '<' || *src_ptr == '>'
|| *src_ptr == '&'
- || *src_ptr == ';') {
+ || *src_ptr == '|'
+ || *src_ptr == '!'
+ || *src_ptr == '$'
+ || *src_ptr == '*'
+ || *src_ptr == '?'
+ || *src_ptr == ';'
+ || *src_ptr == ' ' || *src_ptr == '\t' || *src_ptr == '\n') {
#if 0
/* only if not yet escaped? */
&& (src_ptr == str || (src_ptr > str && *(src_ptr - 1) != '\\'))) {