Update of bug #68687 (group groff):
Status: In Progress => Fixed
Privacy: Private => Public
Open/Closed: Open => Closed
_______________________________________________________
Follow-up Comment #28:
commit 5c67befd2f32e74dcfbfd53f7282a457177c8e4f
Author: G. Branden Robinson <[email protected]>
Date: Mon Sep 28 09:20:56 2026 -0500
[pdfmom]: Regression-test Savannah #68687.
* src/utils/pdfmom/tests/sanitizes-arguments.sh: Do it.
* src/utils/pdfmom/pdfmom.am (pdfmom_TESTS): Run test.
(TESTS, EXTRA_DIST): Wire `pdfmom_TESTS` into Automake test harness
and ship this and any future pdfmom test scripts.
Test fails at this commit.
commit 85e365b71ca8aef7d7e1808c42a73f72fdf1ff18
Author: Deri James <[email protected]>
Date: Wed Sep 23 17:58:44 2026 +0000
[pdfmom]: Fix Savannah #68687.
* src/utils/pdfmom/pdfmom.pl: Pass arguments from command line through
`Clean` subroutine.
(Clean): New subroutinze sanitizes command-line arguments to defeat
command injection vulnerability.
Fixes <https://savannah.gnu.org/bugs/?68687>. Problem appears to date
back to commit f2a501fff5, 2012-08-31, the initial check-in of the
pdfmom command script, which first shipped in groff 1.22.1. Thanks to
Pavol Sloboda for the report and a reproducer.
_______________________________________________________
Reply to this item at:
<https://savannah.gnu.org/bugs/?68687>
_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/
signature.asc
Description: PGP signature
