Re: Comprehensive patch escaping system/open calls in vfs/extfs

[Jakub Jelinek <jakub redhat com>]

On Sat, Aug 21, 2004 at 04:46:37AM +0200, Leonard den Ottolander wrote:
> Hi,
> 
> This is a comprehensive patch that escapes parameters to system and open
> calls that spawn a shell. The patch affects a.in, apt.in, deba.in (parts
> already committed), debd.in, deb.in (parts committed) and dpkg.in.
> 
> Afaict parameters in mailfs.in, patchfs.in and uzip.in are properly
> quoted.
> 
> It's a compilation of the previous patches with a few fixes. Also
> replaced the regular expression with a subroutine "quote".
> 
> Please check for errors and omissions.

You missed 3 places in a.in:

--- extfs/a.in	2004-08-21 13:45:50.000000000 +0200
+++ extfs/a.in	2004-08-21 19:06:15.458358276 +0200
@@ -36,17 +36,20 @@ SWITCH: for ( $ARGV[0] ) {
   /mkdir/ && do {
     shift; shift;
     exit 1 if scalar(@ARGV) != 1;
-    system("$mmd $qdisk:/$ARGV[0] >/dev/null");
+    $qname = quote($ARGV[0]);
+    system("$mmd $qdisk:/$qname >/dev/null");
     exit 0; };
   /rmdir/ && do {
     shift; shift;
     exit 1 if scalar(@ARGV) != 1;
-    system("$mrd $qdisk:/$ARGV[0] >/dev/null");
+    $qname = quote($ARGV[0]);
+    system("$mrd $qdisk:/$qname >/dev/null");
     exit 0; };
   /rm/ && do {
     shift; shift;
     exit 1 if scalar(@ARGV) != 1;
-    system("$mdel $qdisk:/$ARGV[0] >/dev/null");
+    $qname = quote($ARGV[0]);
+    system("$mdel $qdisk:/$qname >/dev/null");
     exit 0; };
   /copyout/ && do {
     shift; shift;

	Jakub