[abcde] Re: Nasty shell evaluation

[Robert Woodcock <rcw@debian.org>]

On Tue, Mar 26, 2002 at 11:58:46AM +0000, Colin Stephen wrote:
> Hi Robert,
> 
> I was encoding the following CD, and saw something alarming in the output.

Luckily this only affects inexact matches - I'd gotten the quoting right for
the other code paths. It can't cause code to be run AFAIK, it just allows
echo to expand unwanted things.

Here's the patch:
--- abcde	Sun Jan 27 21:44:02 2002
+++ abcde	Wed Mar 13 13:57:26 2002
@@ -686,7 +686,7 @@
 					read CDDBCHOICE
 					CDCHOICENUM=$(echo $CDDBCHOICE | xargs printf %d 2>/dev/null)
 				done
-				echo "Selected: #$CDCHOICENUM ($(grep ^DTITLE= $ABCDETEMPDIR/cddbread.$CDCHOICENUM | cut -f2- -d= | tr -d \\r\\n))" >&2
+				echo "Selected: #$CDCHOICENUM ($(grep ^DTITLE= "$ABCDETEMPDIR/cddbread.$CDCHOICENUM" | cut -f2- -d= | tr -d \\r\\n))" >&2
 				echo "cddb-choice=$CDCHOICENUM" >> "$ABCDETEMPDIR/status"
 			fi
 		fi

I'll include this with the next release.
-- 
Robert Woodcock - rcw@debian.org
"Hiring assassins [...] is not something Americans are very good at."
	-- Henry Kissinger
To unsubscribe: echo unsubscribe | mail abcde-request@whimsica.lly.org