From 45ad89b6cddbcb3c112f1c2cdfd4361bc7fdced3 Mon Sep 17 00:00:00 2001 From: Jonas Smedegaard Date: Sat, 9 Feb 2013 19:54:08 +0100 Subject: Dual-quote arguments passed to su_monkeysphere_user() when possible. It is a healthy coding practice to keep each argument separate when executing system calls, i.e. quote each variable separately instead of relying on whitespace to indicate argument separation. Quoting shell-inside-shell is tricky to do right, and gets trickier when the wrapper demands unusually complex quoting. su_monkeysphere_user() expands arguments using "$*" which (unlike "$@") collapses all arguments into a single string, and therefore require "risky" arguments (e.g. ones containing variables that may contain space or other unusual characters) to be dual-quoted for them to not wreak havoc at the inside shell. This patch improves arguments passed to su_monkeysphere_user() by first single-quoting and then double-quoting arguments containing variables. NB! Dynamic arguments are only double-quoted ( "$@" ) which looks safe but effectively is a noop (quoting is lost at wrapper!). --- src/share/ma/remove_certifier | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/share/ma/remove_certifier') diff --git a/src/share/ma/remove_certifier b/src/share/ma/remove_certifier index 9f5be25..6ec9a2d 100644 --- a/src/share/ma/remove_certifier +++ b/src/share/ma/remove_certifier @@ -37,7 +37,7 @@ else fi # delete the requested key from the sphere keyring -if gpg_sphere --delete-key --batch --yes "0x${keyID}!" ; then +if gpg_sphere --delete-key --batch --yes "'0x${keyID}!'" ; then # delete key from core keyring as well gpg_core --delete-key --batch --yes "0x${keyID}!" -- cgit v1.2.3