From f6b65b3b936e6fdd0a29f2b0cead50640a92591a Mon Sep 17 00:00:00 2001 From: Adriaan de Groot Date: Wed, 13 Apr 2022 14:16:57 +0200 Subject: [PATCH] [shellprocess] CommandLine now quotes properly in variable expansion --- src/modules/shellprocess/Tests.cpp | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/modules/shellprocess/Tests.cpp b/src/modules/shellprocess/Tests.cpp index 5d3a503fd..f8727ab36 100644 --- a/src/modules/shellprocess/Tests.cpp +++ b/src/modules/shellprocess/Tests.cpp @@ -190,7 +190,14 @@ script: // But no user set yet QVERIFY( !bool( CommandList( userScript, false, 10s ).run() ) ); - // Now play dangerous games with shell expansion + // Show that shell expansion is now quoted. gs->insert( "username", "`id -u`" ); - QVERIFY( bool( CommandList( userScript, false, 10s ).run() ) ); + { + CalamaresUtils::CommandLine c { QStringLiteral( "chown ${USER}" ), std::chrono::seconds( 0 ) }; + QCOMPARE( c.expand().command(), QStringLiteral( "chown '`id -u`'" ) ); + } + // Now play dangerous games with shell expansion -- except the internal command is now + // quoted, so this fails because it's **highly** unlikely that the literal string + // "`id -u`" is a valid username. + QVERIFY( !bool( CommandList( userScript, false, 10s ).run() ) ); }