Hi, * J.H.M. Dassen (Ray) <[EMAIL PROTECTED]> [2008-09-02 13:07]: > In my ~/.newsbeuter/config I have > browser /usr/bin/w3m > One of the feeds I'm subscribed to features an article link > > http://www.security.nl/artikel/22918/1/Indiërs_kraken_duizend_Captcha's_voor_1_dollar.html > which now results in the following call being made when I press 'o' to open > it: > 4323 execve("/bin/sh", ["sh", "-c", "/usr/bin/w3m > 'http://www.security.nl/artikel/22918/1/Indi\303\253rs_kraken_duizend_Captcha\\'s_voor_1_dollar.html'"], > [/* 50 vars */]) = 0 > This does not work as the shell has no mechanism to quote a single quote > inside a string delimited by single quotes. Using backslashes to quote the > delimiter character only works for double quotes, but within strings > delimited by double quotes, some characters (like backquotes and dollar) > become active which may lead to security concerns again. > > As I understand it, the use of /bin/sh -c was introduced to allow for the > browser command setting to take parameters (bug #496766). Perhaps an easier > way to support this would be not to use /bin/sh -c but instead to split the > browser command setting by spaces and supply the resulting list to execve > directly?
The upstream already tested this but had problems with parts of it. A new fix which converts ' to %27 is on its way. Cheers and thanks Nico -- Nico Golde - http://www.ngolde.de - [EMAIL PROTECTED] - GPG: 0x73647CFF For security reasons, all text in this mail is double-rot13 encrypted.
pgpTHVVi9mAOK.pgp
Description: PGP signature
