Update of /cvsroot/fink/fink/perlmod/Fink
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv23132
Modified Files:
ChangeLog NetAccess.pm
Log Message:
Whoops...quotemeta was a bit overzealous. Dequote standard URL chars that
aren't shell metachars.
Index: NetAccess.pm
===================================================================
RCS file: /cvsroot/fink/fink/perlmod/Fink/NetAccess.pm,v
retrieving revision 1.37
retrieving revision 1.38
diff -u -d -r1.37 -r1.38
--- NetAccess.pm 20 Jan 2005 08:32:07 -0000 1.37
+++ NetAccess.pm 20 Jan 2005 20:39:27 -0000 1.38
@@ -78,7 +78,7 @@
my $downloaddir = shift || "$basepath/src";
my $checksum = shift;
my ($http_proxy, $ftp_proxy);
- my ($url, $cmd, $cont_cmd, $result);
+ my ($url, $cmd, $cont_cmd, $result, $cmd_url);
my $found_archive_sum;
# create destination directory if necessary
@@ -234,6 +234,10 @@
$url .= $path . $basename;
}
+ # protect against shell metachars
+ # deprotect common URI chars that are metachars for regex not
shell
+ ( $cmd_url = "\Q$url\E" ) =~ s{\\([/.:\-=])}{$1}g;
+
### fetch $url to $file
if (!$dryrun && -f $file) {
@@ -247,10 +251,10 @@
if ($dryrun) {
print " $url";
} elsif ($cont) {
- $result = &execute("$cont_cmd \Q$url\E");
+ $result = &execute("$cont_cmd $cmd_url");
$cont = 0;
} else {
- $result = &execute("$cmd \Q$url\E");
+ $result = &execute("$cmd $cmd_url");
}
if ($dryrun or ($result or not -f $file)) {
@@ -306,7 +310,14 @@
# $file is the post-SourceRename tarball name
my $file = shift || &filename($url);
my $cont = shift || 0; # Continue a previously started download?
- my $cmd;
+ my($cmd, $cmd_file);
+
+ # protect against shell metachars
+ # deprotect common URI chars that are metachars for regex not shell
+ if ($file =~ /\//) {
+ die "security error: Cannot use path sep in target filename
(\"$file\")\n";
+ }
+ ( $cmd_file = "\Q$file\E" ) =~ s{\\([/.:\-=])}{$1}g;
# determine the download command
$cmd = "";
@@ -321,7 +332,7 @@
$cmd .= " -P -";
}
if ($file ne &filename($url)) {
- $cmd .= " -o \Q$file\E";
+ $cmd .= " -o $cmd_file";
} else {
$cmd .= " -O"
}
@@ -343,7 +354,7 @@
$cmd .= " --passive-ftp";
}
if ($file ne &filename($url)) {
- $cmd .= " -O \Q$file\E";
+ $cmd .= " -O $cmd_file";
}
if ($cont) {
$cmd .= " -c"
@@ -362,7 +373,7 @@
$cmd .= " --verbose";
}
if ($file ne &filename($url)) {
- $cmd .= " -o \Q$file\E";
+ $cmd .= " -o $cmd_file";
}
# Axel always continues downloads, by default
}
Index: ChangeLog
===================================================================
RCS file: /cvsroot/fink/fink/perlmod/Fink/ChangeLog,v
retrieving revision 1.813
retrieving revision 1.814
diff -u -d -r1.813 -r1.814
--- ChangeLog 20 Jan 2005 08:32:07 -0000 1.813
+++ ChangeLog 20 Jan 2005 20:39:27 -0000 1.814
@@ -1,5 +1,9 @@
2005-01-20 Daniel Macks <[EMAIL PROTECTED]>
+ * NetAccess.pm: Un-quotemeta std URL chars that aren't shell metas.
+
+2005-01-20 Daniel Macks <[EMAIL PROTECTED]>
+
* NetAccess.pm: quotemeta() Source values when used in shell cmd.
2005-01-19 Daniel Macks <[EMAIL PROTECTED]>
-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Fink-commits mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fink-commits
