From 317ca038225c619dbdf53a499794219ea57d317f Mon Sep 17 00:00:00 2001 From: Florian Fischer Date: Tue, 6 Aug 2024 09:08:28 +0200 Subject: improve printf usage Use %s and '' instead of "" to prevent the shell from interpreting the string to print. Escape all occurenses of ' in the string with '"'"' like python's shlex.quote. This prevents shell injection attacks by files with malicious names. --- init.lua | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/init.lua b/init.lua index a857321..1693336 100644 --- a/init.lua +++ b/init.lua @@ -337,7 +337,7 @@ local function lspc_select(choices) end local status, output - local cmd = 'printf "' .. menu_input .. '" | ' .. lspc.menu_cmd + local cmd = 'printf %s \'' .. menu_input:gsub('\'', '\'"\'"\'') .. '\' | ' .. lspc.menu_cmd lspc.log('collect choice using: ' .. cmd) if lspc.menu_cmd:sub(0, 8) == 'vis-menu' then @@ -388,7 +388,7 @@ end local function lspc_confirm(prompt) local choices = 'no\nyes' - local cmd = 'printf "' .. choices .. '" | ' .. lspc.confirm_cmd + local cmd = 'printf %s \'' .. choices .. '\' | ' .. lspc.confirm_cmd if prompt then cmd = cmd .. ' -p \'' .. prompt .. '\'' -- cgit v1.2.3