Re: dircolors database documentation

[Jim Meyering]

> Paul Eggert <address@hidden> wrote:
>> Thanks for catching all these problems.
>>
>> Eric Blake <address@hidden> writes:
>>
>>> Oops - we aren't properly quoting ' in dircolors' output.  This should be
>>> as simple as outputing '\'' in place of ' in append_quoted().
>>
>> That's a serious bug, no?  It lets an attacker execute arbitrary code.
>> Admittedly the attack is unlikely, but we should install something
>> like the following fix right away.  Jim, I assume we're still in a
>> code-freeze now, so I won't install this, but it does look like a
>> fairly safe fix....

I've gone ahead and checked that in, with a new test:

2005-10-18  Paul Eggert  <address@hidden>

        * Version 5.92-cvs.

        * src/dircolors.c (append_quoted): Quote ' correctly.
        Problem reported by Eric Blake.

2005-10-19  Jim Meyering  <address@hidden>

        * tests/dircolors/simple (quote): Add test for the above fix.

Index: tests/dircolors/simple
===================================================================
RCS file: /fetish/cu/tests/dircolors/simple,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -p -u -r1.6 -r1.7
--- tests/dircolors/simple      20 Apr 2005 07:54:54 -0000      1.6
+++ tests/dircolors/simple      19 Oct 2005 07:30:48 -0000      1.7
@@ -23,6 +23,9 @@ my @Tests =
      ['a', {IN => {k => "exec\n"}},
       {ERR => "dircolors: k:1: invalid line;  missing second token\n"},
       {EXIT => 1}],
+     ['quote', {IN => "exec 'echo Hello;:'\n"},
+      {OUT => "LS_COLORS='ex='\\''echo Hello;\\:'\\'':';\n"
+      . "export LS_COLORS\n"}],
     );
 
 my $save_temps = $ENV{DEBUG};