gbranden pushed a commit to branch master
in repository groff.
commit 5c67befd2f32e74dcfbfd53f7282a457177c8e4f
Author: G. Branden Robinson <[email protected]>
AuthorDate: Mon Sep 28 09:20:56 2026 -0500
[pdfmom]: Regression-test Savannah #68687.
* src/utils/pdfmom/tests/sanitizes-arguments.sh: Do it.
* src/utils/pdfmom/pdfmom.am (pdfmom_TESTS): Run test.
(TESTS, EXTRA_DIST): Wire `pdfmom_TESTS` into Automake test harness
and ship this and any future pdfmom test scripts.
Test fails at this commit.
---
ChangeLog | 9 ++++++
src/utils/pdfmom/pdfmom.am | 5 +++
src/utils/pdfmom/tests/sanitizes-arguments.sh | 45 +++++++++++++++++++++++++++
3 files changed, 59 insertions(+)
diff --git a/ChangeLog b/ChangeLog
index 2d59f5964..58f7d1ce9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2026-09-28 G. Branden Robinson <[email protected]>
+
+ [pdfmom]: Regression-test Savannah #68687.
+
+ * src/utils/pdfmom/tests/sanitizes-arguments.sh: Do it.
+ * src/utils/pdfmom/pdfmom.am (pdfmom_TESTS): Run test.
+ (TESTS, EXTRA_DIST): Wire `pdfmom_TESTS` into Automake test
+ harness and ship this and any future pdfmom test scripts.
+
2026-08-06 Bruno Haible <[email protected]>
* doc/doc.am ($(DOC_LINE_LAYOUT_EPS)): Remove the %%CreationDate
diff --git a/src/utils/pdfmom/pdfmom.am b/src/utils/pdfmom/pdfmom.am
index 51f8857da..3736dcc4f 100644
--- a/src/utils/pdfmom/pdfmom.am
+++ b/src/utils/pdfmom/pdfmom.am
@@ -37,6 +37,11 @@ pdfmom: $(pdfmom_dir)/pdfmom.pl $(SH_DEPS_SED_SCRIPT)
>$@ \
&& chmod +x $@
+pdfmom_TESTS = \
+ src/utils/pdfmom/tests/sanitizes-arguments.sh
+TESTS += $(pdfmom_TESTS)
+EXTRA_DIST += $(pdfmom_TESTS)
+
# Local Variables:
# fill-column: 72
# mode: makefile-automake
diff --git a/src/utils/pdfmom/tests/sanitizes-arguments.sh
b/src/utils/pdfmom/tests/sanitizes-arguments.sh
new file mode 100755
index 000000000..a3145b55c
--- /dev/null
+++ b/src/utils/pdfmom/tests/sanitizes-arguments.sh
@@ -0,0 +1,45 @@
+#!/bin/sh
+#
+# Copyright 2026 G. Branden Robinson
+#
+# groff is free software; you can redistribute it and/or modify it under
+# the terms of the GNU General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your
+# option) any later version.
+#
+# groff is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+# for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+pdfmom="${abs_top_builddir:-.}/pdfmom"
+
+# Regression-test Savannah #68687.
+#
+# pdfmom should not permit shell command injection via its arguments.
+
+sandbox_dir=$(mktemp -d)
+if [ $? -ne 0 ]
+then
+ echo "cannot create temporary directory; skipping" >&2
+ exit 77 # skip
+fi
+
+# This method is based on a reproducer by Pavol Sloboda.
+
+oops_file="$sandbox_dir"/oops
+
+"$pdfmom" --roff './$(touch '"$oops_file"').mom'
+
+if ! test -f "$oops_file"
+then
+ rmdir "$sandbox_dir"
+else
+ echo "test failed; file left in \"$oops_file\"" >&2
+ exit 1
+fi
+
+# vim:set autoindent expandtab shiftwidth=4 tabstop=4 textwidth=72:
_______________________________________________
groff-commit mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/groff-commit
