From 68bd7ff51b1299782f956e5daf7aaa6702490482 Mon Sep 17 00:00:00 2001 From: Steffen Jost Date: Wed, 7 Sep 2022 17:58:55 +0200 Subject: [PATCH] refactor(lpr): sanitizing cmd argument properly --- src/Utils/Print.hs | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/Utils/Print.hs b/src/Utils/Print.hs index 0d33de782..e6b7f3f5d 100644 --- a/src/Utils/Print.hs +++ b/src/Utils/Print.hs @@ -333,10 +333,12 @@ readProcess' pc = do sanitizeCmdArg :: Text -> Text sanitizeCmdArg t = - T.snoc (T.cons '"' $ T.filter (\c -> '"' /= c && '\\' /= c) t) '"' + T.snoc (T.cons '\'' $ T.filter (\c -> '\'' /= c && '"' /= c && '\\' /= c) t) '\'' -- | Pin Password is used as a commandline argument in Utils.Print.encryptPDF and hence poses a security risk validCmdArgument :: Text -> Bool -validCmdArgument t = not (T.null t) && (T.cons '"' (T.snoc t '"') == sanitizeCmdArg t) +validCmdArgument t = not (T.null t) && (T.cons '\'' (T.snoc t '\'') == sanitizeCmdArg t) + + ----------- -- pdftk --