From ef53dd80b679b0303dc123ce0a6f00e68683355a Mon Sep 17 00:00:00 2001 From: Karl Berry Date: Sun, 14 Mar 2021 22:19:56 +0000 Subject: escape all shell metacharacters and whitespace git-svn-id: svn://tug.org/texlive/trunk@58347 c570f23f-e606-0410-a88d-b1316a301751 --- Build/source/texk/xdvik/ChangeLog | 13 +++++++++++++ Build/source/texk/xdvik/string-utils.c | 24 +++++++++++++++++------- 2 files changed, 30 insertions(+), 7 deletions(-) (limited to 'Build/source/texk') diff --git a/Build/source/texk/xdvik/ChangeLog b/Build/source/texk/xdvik/ChangeLog index bfb06942ce8..56039658117 100644 --- a/Build/source/texk/xdvik/ChangeLog +++ b/Build/source/texk/xdvik/ChangeLog @@ -1,3 +1,16 @@ +2021-03-14 Karl Berry + + * string-utils.c (shell_escape_string): escape other shell + metacharacters and whitespace. + +2021-03-12 Norbert Preining + + * string-utils.c (shell_escape_string): also escape &. + +2021-03-14 Norbert Preining + + * string-utils.c (shell_escape_string): also escape &. + 2020-03-02 Karl Berry * main.c (is_good_dvi_file): avoid using strnlen, not present diff --git a/Build/source/texk/xdvik/string-utils.c b/Build/source/texk/xdvik/string-utils.c index a09a1b77762..062cd35248f 100644 --- a/Build/source/texk/xdvik/string-utils.c +++ b/Build/source/texk/xdvik/string-utils.c @@ -635,10 +635,10 @@ canonicalize_path(const char *path) return start; } -/* Escape all of the following characters in str: - ` \ ; ( ) & - making it safe to pass str to a shell. Return result in a newly - allocated string, which the caller is responsible to free() after use. +/* Escape shell metacharacters in str, hopefully making it safe to pass + str to system(), i.e., /bin/sh -c, without further quoting. Return + result in a newly allocated string, which the caller is responsible + to free() after use. */ char * shell_escape_string(const char *str) @@ -651,10 +651,20 @@ shell_escape_string(const char *str) while (*src_ptr != '\0') { if (*src_ptr == '\\' || *src_ptr == '`' - || *src_ptr == '(' - || *src_ptr == ')' + || *src_ptr == '\'' + || *src_ptr == '"' + || *src_ptr == '(' || *src_ptr == ')' + || *src_ptr == '{' || *src_ptr == '}' + || *src_ptr == '[' || *src_ptr == ']' + || *src_ptr == '<' || *src_ptr == '>' || *src_ptr == '&' - || *src_ptr == ';') { + || *src_ptr == '|' + || *src_ptr == '!' + || *src_ptr == '$' + || *src_ptr == '*' + || *src_ptr == '?' + || *src_ptr == ';' + || *src_ptr == ' ' || *src_ptr == '\t' || *src_ptr == '\n') { #if 0 /* only if not yet escaped? */ && (src_ptr == str || (src_ptr > str && *(src_ptr - 1) != '\\'))) { -- cgit v1.2.3