Bug 823669 - jpackage-utils: abs2rel.sh passes arguments to lua script incorrectly
Summary: jpackage-utils: abs2rel.sh passes arguments to lua script incorrectly
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: jpackage-utils
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
low
Target Milestone: ---
Assignee: jiri vanek
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-05-21 20:12 UTC by Tomas Hoger
Modified: 2013-04-08 09:52 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-12-13 11:11:04 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
Handle command line arguments in abs2rel.lua (584 bytes, patch)
2012-05-21 20:12 UTC, Tomas Hoger
no flags Details | Diff
Reimplement abs2rel.sh using perl File::Spec module (3.42 KB, patch)
2012-12-03 16:53 UTC, Mikolaj Izdebski
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 948161 0 unspecified CLOSED F19 jpackage-utils has grown a dep on perl 2021-02-22 00:41:40 UTC

Internal Links: 948161

Description Tomas Hoger 2012-05-21 20:12:45 UTC
Created attachment 585883 [details]
Handle command line arguments in abs2rel.lua

Description of problem:
abs2rel.sh uses its arguments in a string to be evaluated as lua program.  Certain special characters in those arguments, e.g. ", can cause it to fail because of an incorrect quoting.

This can be fixed by making lua script handle its arguments instead, see attached patch.  Not that it makes shell wrapper rather pointless and should allow calling lua directly from .spec scripts:

%define abs2rel lua %{_datadir}/java-utils/abs2rel.lua

Additional info:

Compared to the original perl version, there are few differences not addressed in the patch (but also not relevant to how abs2rel is currently used):
- the second argument is not optional
- relative paths are handled as absolute

Comment 1 Deepak Bhole 2012-07-06 17:41:42 UTC
Jiri, can you please investigate?

Comment 2 jiri vanek 2012-07-13 14:17:50 UTC
Well this solution is even more funny but unless  there are more affected chars then quotes (what I doubt) then it is going to work and will keep the script nearly untouched.

a=`echo $1|sed s,\",\\\\\\\\\",g` ;
b=`echo $2|sed s,\",\\\\\\\\\",g` ;
(cd `dirname $0` && lua -l abs2rel -e "print(abs2rel(\"$a\", \"$b\"))")

Comment 3 Tomas Hoger 2012-07-13 16:01:19 UTC
$ ./funny-abs2rel.sh '' '\"));os.execute([[echo BLEH]]);--'

BLEH

Comment 5 Mikolaj Izdebski 2012-12-03 16:53:25 UTC
Created attachment 656831 [details]
Reimplement abs2rel.sh using perl File::Spec module

This patch resolves 2 bugs (this one and also bug #882578)

Comment 7 Stanislav Ochotnicky 2012-12-13 11:11:04 UTC
I've applied patch from comment 5. & build jpackage-utils.


Note You need to log in before you can comment on or make changes to this bug.