napcok/calamares
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[shellprocess] CommandLine now quotes properly in variable expansion

Browse Source
This commit is contained in:
Adriaan de Groot 2022-04-13 14:16:57 +02:00
parent bbea67ecb4
commit f6b65b3b93
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/modules/shellprocess/Tests.cpp
View File

@ -190,7 +190,14 @@ script:
// But no user set yet
QVERIFY( !bool( CommandList( userScript, false, 10s ).run() ) );
// Now play dangerous games with shell expansion
// Show that shell expansion is now quoted.
gs->insert( "username", "`id -u`" );
QVERIFY( bool( CommandList( userScript, false, 10s ).run() ) );
{
CalamaresUtils::CommandLine c { QStringLiteral( "chown ${USER}" ), std::chrono::seconds( 0 ) };
QCOMPARE( c.expand().command(), QStringLiteral( "chown '`id -u`'" ) );
}
// Now play dangerous games with shell expansion -- except the internal command is now
// quoted, so this fails because it's **highly** unlikely that the literal string
// "`id -u`" is a valid username.
QVERIFY( !bool( CommandList( userScript, false, 10s ).run() ) );
}