Bug 823669 - jpackage-utils: abs2rel.sh passes arguments to lua script incorrectly
jpackage-utils: abs2rel.sh passes arguments to lua script incorrectly
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: jpackage-utils (Show other bugs)
rawhide
Unspecified Unspecified
unspecified Severity low
: ---
: ---
Assigned To: jiri vanek
Fedora Extras Quality Assurance
: Patch
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-05-21 16:12 EDT by Tomas Hoger
Modified: 2013-04-08 05:52 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-12-13 06:11:04 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Handle command line arguments in abs2rel.lua (584 bytes, patch)
2012-05-21 16:12 EDT, Tomas Hoger
no flags Details | Diff
Reimplement abs2rel.sh using perl File::Spec module (3.42 KB, patch)
2012-12-03 11:53 EST, Mikolaj Izdebski
no flags Details | Diff

  None (edit)
Description Tomas Hoger 2012-05-21 16:12:45 EDT
Created attachment 585883 [details]
Handle command line arguments in abs2rel.lua

Description of problem:
abs2rel.sh uses its arguments in a string to be evaluated as lua program.  Certain special characters in those arguments, e.g. ", can cause it to fail because of an incorrect quoting.

This can be fixed by making lua script handle its arguments instead, see attached patch.  Not that it makes shell wrapper rather pointless and should allow calling lua directly from .spec scripts:

%define abs2rel lua %{_datadir}/java-utils/abs2rel.lua

Additional info:

Compared to the original perl version, there are few differences not addressed in the patch (but also not relevant to how abs2rel is currently used):
- the second argument is not optional
- relative paths are handled as absolute
Comment 1 Deepak Bhole 2012-07-06 13:41:42 EDT
Jiri, can you please investigate?
Comment 2 jiri vanek 2012-07-13 10:17:50 EDT
Well this solution is even more funny but unless  there are more affected chars then quotes (what I doubt) then it is going to work and will keep the script nearly untouched.

a=`echo $1|sed s,\",\\\\\\\\\",g` ;
b=`echo $2|sed s,\",\\\\\\\\\",g` ;
(cd `dirname $0` && lua -l abs2rel -e "print(abs2rel(\"$a\", \"$b\"))")
Comment 3 Tomas Hoger 2012-07-13 12:01:19 EDT
$ ./funny-abs2rel.sh '' '\"));os.execute([[echo BLEH]]);--'

BLEH
Comment 5 Mikolaj Izdebski 2012-12-03 11:53:25 EST
Created attachment 656831 [details]
Reimplement abs2rel.sh using perl File::Spec module

This patch resolves 2 bugs (this one and also bug #882578)
Comment 7 Stanislav Ochotnicky 2012-12-13 06:11:04 EST
I've applied patch from comment 5. & build jpackage-utils.

Note You need to log in before you can comment on or make changes to this bug.