commit 0e973e52a012e7f935e489a4295b928d444fe178
Author: Pavel Sanda <[email protected]>
Date: Thu Jun 4 13:20:02 2026 +0200
Hardening case 00a - arbitrary command execution via kpsewhich filename
findtexfile() runs ("kpsewhich " + fil) directly through shell without
sanitization of fil. That leaves it open to arbitrary commands injected
as filenames inside .lyx file.
Fires on .lyx load + export.
Tier 00 hotfix: pass fil quoted and after a "--" separator.
Tier 01 DiD will land in master (argv-form kpsewhich).
Assisted-by: Claude Opus 4.7
---
src/support/filetools.cpp | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/src/support/filetools.cpp b/src/support/filetools.cpp
index e0dc4e7654..823ff78728 100644
--- a/src/support/filetools.cpp
+++ b/src/support/filetools.cpp
@@ -1227,7 +1227,22 @@ FileName const findtexfile(string const & fil, string
const & /*format*/,
// tfm - TFMFONTS, TEXFONTS
// This means that to use kpsewhich in the best possible way we
// should help it by setting additional path in the approp. envir.var.
- string const kpsecmd = "kpsewhich " + fil;
+
+ if (fil.empty())
+ return FileName();
+
+ // Wrap fil in the shell's quoting form that disables the relevant
+ // metacharacter set.
+#ifdef _WIN32
+ // Reject '"' in filename, can't be backslashed & forbidden by NTFS
anyway
+ if (fil.find('"') != string::npos)
+ return FileName();
+ // disable metacharacters
+ string const kpsecmd = "kpsewhich -- \"" + fil + "\"";
+#else
+ // disable metacharacters & escape existing '
+ string const kpsecmd = "kpsewhich -- '" + subst(fil, "'", "'\\''") +
"'";
+#endif
cmd_ret const c = runCommand(kpsecmd);
--
lyx-cvs mailing list
[email protected]
https://lists.lyx.org/mailman/listinfo/lyx-cvs
