From 45ad89b6cddbcb3c112f1c2cdfd4361bc7fdced3 Mon Sep 17 00:00:00 2001 From: Jonas Smedegaard Date: Sat, 9 Feb 2013 19:54:08 +0100 Subject: Dual-quote arguments passed to su_monkeysphere_user() when possible. It is a healthy coding practice to keep each argument separate when executing system calls, i.e. quote each variable separately instead of relying on whitespace to indicate argument separation. Quoting shell-inside-shell is tricky to do right, and gets trickier when the wrapper demands unusually complex quoting. su_monkeysphere_user() expands arguments using "$*" which (unlike "$@") collapses all arguments into a single string, and therefore require "risky" arguments (e.g. ones containing variables that may contain space or other unusual characters) to be dual-quoted for them to not wreak havoc at the inside shell. This patch improves arguments passed to su_monkeysphere_user() by first single-quoting and then double-quoting arguments containing variables. NB! Dynamic arguments are only double-quoted ( "$@" ) which looks safe but effectively is a noop (quoting is lost at wrapper!). --- src/share/mh/publish_key | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/share/mh/publish_key') diff --git a/src/share/mh/publish_key b/src/share/mh/publish_key index 9c41bc2..9fb2e72 100644 --- a/src/share/mh/publish_key +++ b/src/share/mh/publish_key @@ -53,7 +53,7 @@ done # publish key log debug "publishing key with the following gpg command line and options:" su_monkeysphere_user \ - gpg --keyserver "$KEYSERVER" ${ANCHORFILE:+--keyserver-options "ca-cert-file=$ANCHORFILE"} --send-keys "0x${keyID}!" + gpg --keyserver "'$KEYSERVER'" ${ANCHORFILE:+--keyserver-options "'ca-cert-file=$ANCHORFILE'"} --send-keys "'0x${keyID}!'" # remove the tmp file trap - EXIT -- cgit v1.2.3