diff options
| author | Florian Fischer <florian.fischer@muhq.space> | 2024-08-06 09:08:28 +0200 |
|---|---|---|
| committer | Florian Fischer <florian.fischer@muhq.space> | 2024-08-07 18:24:02 +0200 |
| commit | 317ca038225c619dbdf53a499794219ea57d317f (patch) | |
| tree | ea5f505fe1e433980dbee27fc53d4601e1159a33 | |
| parent | 319a6b322ea34add387bd356d3d3fb9c6fd3b1ff (diff) | |
| download | vis-lspc-317ca038225c619dbdf53a499794219ea57d317f.tar.gz vis-lspc-317ca038225c619dbdf53a499794219ea57d317f.zip | |
improve printf usage
Use %s and '' instead of "" to prevent the shell from interpreting the string
to print.
Escape all occurenses of ' in the string with '"'"' like python's shlex.quote.
This prevents shell injection attacks by files with malicious names.
| -rw-r--r-- | init.lua | 4 |
1 files changed, 2 insertions, 2 deletions
@@ -337,7 +337,7 @@ local function lspc_select(choices) end local status, output - local cmd = 'printf "' .. menu_input .. '" | ' .. lspc.menu_cmd + local cmd = 'printf %s \'' .. menu_input:gsub('\'', '\'"\'"\'') .. '\' | ' .. lspc.menu_cmd lspc.log('collect choice using: ' .. cmd) if lspc.menu_cmd:sub(0, 8) == 'vis-menu' then @@ -388,7 +388,7 @@ end local function lspc_confirm(prompt) local choices = 'no\nyes' - local cmd = 'printf "' .. choices .. '" | ' .. lspc.confirm_cmd + local cmd = 'printf %s \'' .. choices .. '\' | ' .. lspc.confirm_cmd if prompt then cmd = cmd .. ' -p \'' .. prompt .. '\'' |