|
 |
ee26d5 |
From a8006ea580ed74f27f974d60b598143b04ad1741 Mon Sep 17 00:00:00 2001
|
|
|
ee26d5 |
From: Xi Lu <lx@shellcodes.org>
|
|
|
ee26d5 |
Date: Sat, 11 Mar 2023 18:53:37 +0800
|
|
|
ee26d5 |
Subject: * lisp/org/ob-latex.el: Fix command injection vulnerability
|
|
|
ee26d5 |
|
|
|
ee26d5 |
(org-babel-execute:latex):
|
|
|
ee26d5 |
Replaced the `(shell-command "mv BAR NEWBAR")' with `rename-file'.
|
|
|
ee26d5 |
|
|
|
ee26d5 |
TINYCHANGE
|
|
|
ee26d5 |
---
|
|
|
ee26d5 |
lisp/org/ob-latex.el | 13 +++++--------
|
|
|
ee26d5 |
1 file changed, 5 insertions(+), 8 deletions(-)
|
|
|
ee26d5 |
|
|
|
ee26d5 |
diff --git a/lisp/org/ob-latex.el b/lisp/org/ob-latex.el
|
|
|
ee26d5 |
index a2c24b3..ce39628 100644
|
|
|
ee26d5 |
--- a/lisp/org/ob-latex.el
|
|
|
ee26d5 |
+++ b/lisp/org/ob-latex.el
|
|
|
ee26d5 |
@@ -218,17 +218,14 @@ This function is called by `org-babel-execute-src-block'."
|
|
|
ee26d5 |
(if (string-suffix-p ".svg" out-file)
|
|
|
ee26d5 |
(progn
|
|
|
ee26d5 |
(shell-command "pwd")
|
|
|
ee26d5 |
- (shell-command (format "mv %s %s"
|
|
|
ee26d5 |
- (concat (file-name-sans-extension tex-file) "-1.svg")
|
|
|
ee26d5 |
- out-file)))
|
|
|
ee26d5 |
+ (rename-file (concat (file-name-sans-extension tex-file) "-1.svg")
|
|
|
ee26d5 |
+ out-file t))
|
|
|
ee26d5 |
(error "SVG file produced but HTML file requested")))
|
|
|
ee26d5 |
((file-exists-p (concat (file-name-sans-extension tex-file) ".html"))
|
|
|
ee26d5 |
(if (string-suffix-p ".html" out-file)
|
|
|
ee26d5 |
- (shell-command "mv %s %s"
|
|
|
ee26d5 |
- (concat (file-name-sans-extension tex-file)
|
|
|
ee26d5 |
- ".html")
|
|
|
ee26d5 |
- out-file)
|
|
|
ee26d5 |
- (error "HTML file produced but SVG file requested")))))
|
|
|
ee26d5 |
+ (rename-file (concat (file-name-sans-extension tex-file) ".html")
|
|
|
ee26d5 |
+ out-file t)
|
|
|
ee26d5 |
+ (error "HTML file produced but SVG file requested")))))
|
|
|
ee26d5 |
((or (string= "pdf" extension) imagemagick)
|
|
|
ee26d5 |
(with-temp-file tex-file
|
|
|
ee26d5 |
(require 'ox-latex)
|
|
|
ee26d5 |
--
|
|
|
ee26d5 |
cgit v1.1
|
|
|
ee26d5 |
|