Merge remote-tracking branch 'origin/pr/266'

* origin/pr/266: Only allow known-safe characters in socket paths
2020-12-01 03:57:57 +01:00 · 2020-12-01 03:57:57 +01:00 · 5ddc118429
commit 5ddc118429
parent 6da7f77013 06d84b5198
1 changed files with 3 additions and 2 deletions
--- a/qubes-rpc/qubes.ShowInTerminal
+++ b/qubes-rpc/qubes.ShowInTerminal
@ -1,10 +1,11 @@
 #!/bin/bash --

 set -eu
+umask 0077
 tmpdir="$(mktemp -d)"

-if [[ $tmpdir =~ \" ]]; then
-    echo 'Error: non admissible character detected in sock path.'
+if ! [[ $tmpdir =~ ^/[/A-Za-z0-9._-]+$ ]]; then
+    echo 'Error: non admissible character detected in sock path.'>&2
    exit 1
 fi