Package: newsbeuter / 2.9-5+deb9u2

23-Work-around-shell-code-in-podcast-names-598.patch Patch series | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
From: Alexander Batischev <eual.jp@gmail.com>
Date: Sat, 16 Sep 2017 19:31:43 +0300
Subject: Work around shell code in podcast names (#598)
Origin: https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb04660f333
Bug: https://github.com/akrennmair/newsbeuter/issues/598
Bug-Debian: https://bugs.debian.org/876004
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-14500

---
 src/pb_controller.cpp | 6 +++---
 src/queueloader.cpp   | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/pb_controller.cpp b/src/pb_controller.cpp
index 09b5e89..213216c 100644
--- a/src/pb_controller.cpp
+++ b/src/pb_controller.cpp
@@ -306,9 +306,9 @@ void pb_controller::play_file(const std::string& file) {
 	if (player == "")
 		return;
 	cmdline.append(player);
-	cmdline.append(" \"");
-	cmdline.append(utils::replace_all(file,"\"", "\\\""));
-	cmdline.append("\"");
+	cmdline.append(" \'");
+	cmdline.append(utils::replace_all(file,"'", "%27"));
+	cmdline.append("\'");
 	stfl::reset();
 	LOG(LOG_DEBUG, "pb_controller::play_file: running `%s'", cmdline.c_str());
 	::system(cmdline.c_str());
diff --git a/src/queueloader.cpp b/src/queueloader.cpp
index c1dabdd..ae725e0 100644
--- a/src/queueloader.cpp
+++ b/src/queueloader.cpp
@@ -130,7 +130,7 @@ std::string queueloader::get_filename(const std::string& str) {
 		strftime(lbuf, sizeof(lbuf), "%Y-%b-%d-%H%M%S.unknown", localtime(&t));
 		fn.append(lbuf);
 	} else {
-		fn.append(base);
+		fn.append(utils::replace_all(base, "'", "%27"));
 	}
 	return fn;
 }
-- 
2.14.1