From c722d09429763fac48c9e84dd037f2576da985bd Mon Sep 17 00:00:00 2001 From: "dylan.araps@gmail.com" Date: Tue, 1 Oct 2019 19:48:30 +0000 Subject: kiss: more relaxed sanitization as per POSIX globbing spec. FossilOrigin-Name: 33ed6d93f3e9f757af1c88c985fd88d39ee37cec63bc6a4e1b0960f2479effd7 --- kiss | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kiss b/kiss index a05a46a..88a758f 100755 --- a/kiss +++ b/kiss @@ -858,9 +858,12 @@ args() { # Unless this is a search, sanitize the user's input. The call to # 'pkg_find()' supports basic globbing, ensure input doesn't expand # to anything except for when this behavior is needed. + # + # This handles the globbing characters '*', '!', '[' and ']' as per: + # https://pubs.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html [ "$action" != search ] && [ "$action" != s ] && case $* in - *[!a-zA-Z0-9_-]*) + *'*'*|*'!'*|*'['*|*']'*) log kiss "$action $*" die "Arguments contain invalid characters" ;; -- cgit v1.2.3