Escape shell characters in the erc arguments

Since `eval "$4"` is frequently used within the external rules command,
we want to avoid the possibility of unwanted code execution.

Fixes #1162.
Closes #1161.

diff --git a/src/helpers.c b/src/helpers.c
index 57a82bdd8939da1ff9d1a7f760ac6f119cd28b5e..84199b68a7f28733f7009030a48716402b11b16c 100644 (file)
--- a/src/helpers.c
+++ b/src/helpers.c
@@ -119,6 +119,35 @@ char *copy_string(char *str, size_t len)
        return cpy;
 }
 
+char *shell_escape(char *s)
+{
+       char *e = malloc(2 * strlen(s) + 1);
+
+       if (e == NULL) {
+               return NULL;
+       }
+
+       int c = 0;
+       int j = 0;
+
+       for (size_t i = 0; i < strlen(s); i++) {
+               if (s[i] == '\\') {
+                       c += 1;
+               } else {
+                       if (s[i] == '$' || s[i] == '(' || s[i] == ')') {
+                               if (c % 2 == 0) {
+                                       e[j++] = '\\';
+                               }
+                       }
+                       c = 0;
+               }
+               e[j++] = s[i];
+       }
+
+       e[j] = '\0';
+       return e;
+}
+
 char *mktempfifo(const char *template)
 {
        int tempfd;

diff --git a/src/helpers.h b/src/helpers.h
index c65ebbe5cccba3ee60cc767480ddd5ffa57c8abb..fcff1e037f07e86897d0b6c9bcaaf77f75d320a5 100644 (file)
--- a/src/helpers.h
+++ b/src/helpers.h
@@ -79,6 +79,7 @@ void warn(char *fmt, ...);
 void err(char *fmt, ...);
 char *read_string(const char *file_path, size_t *tlen);
 char *copy_string(char *str, size_t len);
+char *shell_escape(char *s);
 char *mktempfifo(const char *template);
 int asprintf(char **buf, const char *fmt, ...);
 int vasprintf(char **buf, const char *fmt, va_list args);

diff --git a/src/query.c b/src/query.c
index 23ae367387a600bdfe1ff1e5e3ff1ccaeedeaa4a..f558392183fb1c7890547429bc867d298409f36d 100644 (file)
--- a/src/query.c
+++ b/src/query.c
@@ -434,15 +434,25 @@ void print_rule_consequence(char **buf, rule_consequence_t *csq)
                rect_buf = malloc(1);
                *rect_buf = '\0';
        }
+       char *monitor_desc = shell_escape(csq->monitor_desc);
+       char *desktop_desc = shell_escape(csq->desktop_desc);
+       char *node_desc = shell_escape(csq->node_desc);
+       char *split_dir = shell_escape(csq->split_dir);
        asprintf(buf, "monitor=%s desktop=%s node=%s state=%s layer=%s split_dir=%s split_ratio=%lf hidden=%s sticky=%s private=%s locked=%s marked=%s center=%s follow=%s manage=%s focus=%s border=%s rectangle=%s",
-               csq->monitor_desc, csq->desktop_desc, csq->node_desc,
+               monitor_desc == NULL ? "" : monitor_desc,
+               desktop_desc == NULL ? "" : desktop_desc,
+               node_desc == NULL ? "" : node_desc,
                csq->state == NULL ? "" : STATE_STR(*csq->state),
                csq->layer == NULL ? "" : LAYER_STR(*csq->layer),
-               csq->split_dir, csq->split_ratio,
+               split_dir == NULL ? "" : split_dir, csq->split_ratio,
                ON_OFF_STR(csq->hidden), ON_OFF_STR(csq->sticky), ON_OFF_STR(csq->private),
                ON_OFF_STR(csq->locked), ON_OFF_STR(csq->marked), ON_OFF_STR(csq->center), ON_OFF_STR(csq->follow),
                ON_OFF_STR(csq->manage), ON_OFF_STR(csq->focus), ON_OFF_STR(csq->border), rect_buf);
        free(rect_buf);
+       free(monitor_desc);
+       free(desktop_desc);
+       free(node_desc);
+       free(split_dir);
 }
 
 void print_rectangle(char **buf, xcb_rectangle_t *rect)