]> git.donarmstrong.com Git - lilypond.git/blob - debian/patches/Issue-5243-2-Let-get-editor-use-shell-quote-argument.diff
Fix argument injection in lilypond-invoke-editor, CVE-2017-17523.
[lilypond.git] / debian / patches / Issue-5243-2-Let-get-editor-use-shell-quote-argument.diff
1 From: David Kastrup <dak@gnu.org>
2 Date: Tue, 28 Nov 2017 11:19:02 +0000 (+0100)
3 Subject: Issue 5243/2: Let get-editor use shell-quote-argument
4 X-Git-Url: http://git.savannah.gnu.org/gitweb/?p=lilypond.git;a=commitdiff_plain;h=39f800a7e5acb7cc5da6424c99fd2690e389495a
5
6 Issue 5243/2: Let get-editor use shell-quote-argument
7
8 Addresses security concerns.
9 ---
10
11 diff --git a/scm/editor.scm b/scm/editor.scm
12 index 9406055..f0132a0 100644
13 --- a/scm/editor.scm
14 +++ b/scm/editor.scm
15 @@ -169,7 +169,7 @@ See Info node `(elisp)Security Considerations'."
16    (let* ((editor (get-editor))
17           (template (get-command-template editor-command-template-alist editor))
18           (command
19 -          (re-sub "%\\(file\\)s" (format #f "~S" file-name)
20 +          (re-sub "%\\(file\\)s" (shell-quote-argument file-name)
21                    (re-sub "%\\(line\\)s" (format #f "~a" line)
22                            (re-sub "%\\(char\\)s" (format #f "~a" char)
23                                    (re-sub
24