commit ad4dafc943f203954dd051045e475e332dbc4a38
Author: Pavel Sanda <[email protected]>
Date: Fri Sep 11 22:12:22 2026 +0200
Route the lyx2lyx invocation through argv form
Retires runCommand() & sh_quote() guard (fragile to get right across
platforms to avoid command injection) from lyx2lyx conversion chain.
Missing python interpreter now reports before spawning rather than
failing later.
Tier 01 DiD / argv 03b: argv-form lyx2lyx
re-closes 00b (f3a89bd504) structurally
https://www.mail-archive.com/[email protected]/msg226806.html
Assisted-by: Claude Opus 5
---
src/Buffer.cpp | 40 +++++++++++++++++++---------------------
1 file changed, 19 insertions(+), 21 deletions(-)
diff --git a/src/Buffer.cpp b/src/Buffer.cpp
index 7af7398d5d..c2d0107173 100644
--- a/src/Buffer.cpp
+++ b/src/Buffer.cpp
@@ -1411,28 +1411,26 @@ Buffer::ReadStatus Buffer::convertLyXFormat(FileName
const & fn,
// Run lyx2lyx:
// $python$ "$lyx2lyx$" -t $LYX_FORMAT$ -o "$tempfile$" "$filetoread$"
+ //
+ // fn is user-controlled string, we need argv form of invocation
+ vector<string> argv = os::pythonArgvForm();
+ if (argv.empty()) {
+ LYXERR0("No python interpreter found, cannot run lyx2lyx.");
+ return LyX2LyXNotFound;
+ }
+ string const program = argv.front();
+ argv.erase(argv.begin());
+ argv.push_back(lyx2lyx.toFilesystemEncoding());
+ argv.push_back("-t");
+ argv.push_back(convert<string>(LYX_FORMAT));
+ argv.push_back("-o");
+ argv.push_back(tmpfile.toSafeFilesystemEncoding());
+ argv.push_back(fn.toSafeFilesystemEncoding());
- // guard against command expansion in filename strings on linux,
- // keep " on windows
- auto sh_quote = [](string const & s) -> string {
-#ifdef _WIN32
- return quoteName(s);
-#else
- return '\'' + subst(s, "'", "'\\''") + '\'';
-#endif
- };
- ostringstream command;
- command << os::python()
- << ' ' << sh_quote(lyx2lyx.toFilesystemEncoding())
- << " -t " << convert<string>(LYX_FORMAT)
- << " -o " << sh_quote(tmpfile.toSafeFilesystemEncoding())
- << ' ' << sh_quote(fn.toSafeFilesystemEncoding());
- string const command_str = command.str();
-
- LYXERR(Debug::INFO, "Running '" << command_str << '\'');
-
- cmd_ret const ret = runCommand(command_str);
- if (!ret.valid) {
+ LYXERR(Debug::INFO, "Running lyx2lyx on '" << fn.absFileName() << '\'');
+
+ Systemcall one;
+ if (one.startscriptArgv(program, argv) != Systemcall::OK) {
if (from_format < LYX_FORMAT) {
Alert::error(_("Conversion script failed"),
bformat(_("%1$s is from an older version"
--
lyx-cvs mailing list
[email protected]
https://lists.lyx.org/mailman/listinfo/lyx-cvs
