|
runner_run built "/bin/sh -c " + cmd and ran g_shell_parse_argv on it,
which split the command into argv words — sh -c then received only the
first word as its script and treated the rest as $0/$1..., silently
truncating multi-word commands, pipelines, and redirections. The
existing 'true %f' test passed only because true ignores missing args.
Build argv directly as {"/bin/sh", "-c", c_cmd, NULL} so sh -c gets
the whole expanded command as one script string. %f/%d stay single-
quoted via g_shell_quote, so hostile filenames cannot break out of the
quotes and inject commands. Also removed dead code in _shell_quote.
New observable tests (write to a temp file, read it back):
- multi_word: printf 'hello world' (would fail on old code)
- pipeline: echo | cat
- redirection: echo > file
- spaces_in_args: printf 'a b c'
- hostile_filename: ';touch sentinel;' name must NOT create the sentinel
|
|
M8 (partial): plain-C operate modules + unit tests.
- src/mover.{c,h}: move files to configured dests (g_file_move + stem
collision suffix -1/-2), one-level undo (move back), acts on marks-or-current.
- src/opener.{c,h}: %f expand + detached GSubprocess launch (non-blocking).
- src/runner.{c,h}: /bin/sh -c with single-quoted %f/%d (injection guard),
async wait_check, rescan on completion.
- src/clipboard.{c,h}: image/png via GdkContentProvider + uri-list.
- meson: new sources added to libggae.
- tests: unit test_mover (move/undo/collision), test_opener (true/false/weird
filenames), test_runner (true/false/injection guard). 19/19 green, ASan clean.
- Fixed: g_str_replace (not in GLib 2.88) → manual _str_replace; GdkContentProvider
API (new_typed/new_for_value); mover collision stem-suffix; runner /bin/sh -c
argv (single arg, not shell-parsed); test GFile leaks.
|
