On Mon, Aug 31, 2026 at 09:54:20PM +0200, Pavel Sanda wrote: > The first batch of patches tries to sanitize runCommand() calls.
The next one uses new startscriptArgv to close kpsewhich hole in a less fragile way. Pavel
>From eb1d143df06824cd2d64988344eed0e910d12e3d Mon Sep 17 00:00:00 2001 From: Pavel Sanda <[email protected]> Date: Sat, 23 May 2026 19:58:10 +0200 Subject: [PATCH 02/11] Route kpsewhich invocation through argv form Use startscriptArgv() instead of fragile quoting hotfixes. The "--" separator stays: kpsewhich would otherwise read '-' as an option flag. Tier 01 DiD / argv 02: argv-form kpsewhich; re-closes 00a structurally, removes one runCommand caller Assisted-by: Claude Opus 4.7 --- src/support/filetools.cpp | 26 +++++++----------------- 1 file changed, 9 insertions(+), 17 deletions(-) diff --git a/src/support/filetools.cpp b/src/support/filetools.cpp index f92d5a1843..7dd72e37b0 100644 --- a/src/support/filetools.cpp +++ b/src/support/filetools.cpp @@ -1259,25 +1259,16 @@ FileName const findtexfile(string const & fil, string const & /*format*/, if (fil.empty()) return FileName(); - // Wrap fil in the shell's quoting form that disables the relevant - // metacharacter set. -#ifdef _WIN32 - // Reject '"' in filename, can't be backslashed & forbidden by NTFS anyway - if (fil.find('"') != string::npos) - return FileName(); - // disable metacharacters - string const kpsecmd = "kpsewhich -- \"" + fil + "\""; -#else - // disable metacharacters & escape existing ' - string const kpsecmd = "kpsewhich -- '" + subst(fil, "'", "'\\''") + "'"; -#endif - - cmd_ret const c = runCommand(kpsecmd); + // fil is user-controlled (e.g. the bibfiles parameter of a CommandInset bibtex) - + // avoid shell & arguments parsing. Keep "--" to delimit kpsewhich options. + Systemcall one; + string kpse_out; + int const ret = one.startscriptArgv("kpsewhich", { "--", fil }, &kpse_out); - LYXERR(Debug::OUTFILE, "kpse status = " << c.valid << '\n' - << "kpse result = `" << rtrim(c.result, "\n\r") << '\''); - if (c.valid) - return FileName(rtrim(to_utf8(from_filesystem8bit(c.result)), "\n\r")); + LYXERR(Debug::OUTFILE, "kpse status = " << ret << '\n' + << "kpse result = `" << rtrim(kpse_out, "\n\r") << '\''); + if (ret == Systemcall::OK) + return FileName(rtrim(to_utf8(from_filesystem8bit(kpse_out)), "\n\r")); else return FileName(); } -- 2.39.5
-- lyx-devel mailing list [email protected] https://lists.lyx.org/mailman/listinfo/lyx-devel
