Bug#726638: improved patch for filenames with shell metacharacters or whitespace

2014-04-16 Thread Jameson Graef Rollins
On Wed, Apr 16 2014, Daniel Kahn Gillmor wrote: > On 04/16/2014 05:48 PM, Jameson Graef Rollins wrote: >> I actually don't want the spawned process to be owned by xapers. If >> it's owned by xapers then closing xapers closes the opened paper. >> That's why I used the technique that I did. > > hm,

Bug#726638: improved patch for filenames with shell metacharacters or whitespace

2014-04-16 Thread Daniel Kahn Gillmor
On 04/16/2014 05:48 PM, Jameson Graef Rollins wrote: > I actually don't want the spawned process to be owned by xapers. If > it's owned by xapers then closing xapers closes the opened paper. > That's why I used the technique that I did. hm, that doesn't happen for me (i just tested). can you p

Bug#726638: improved patch for filenames with shell metacharacters or whitespace

2014-04-16 Thread Jameson Graef Rollins
On Wed, Apr 16 2014, Daniel Kahn Gillmor wrote: > Attached is an improved patch that should help xapers handle not only > whitespace in filenames, but also safely handle filenames with shell > metacharacters. we should never set shell=True if at all possible, > especially when the pdf filename ma

Bug#726638: improved patch for filenames with shell metacharacters or whitespace

2014-04-16 Thread Daniel Kahn Gillmor
Control: tags -1 + patch Attached is an improved patch that should help xapers handle not only whitespace in filenames, but also safely handle filenames with shell metacharacters. we should never set shell=True if at all possible, especially when the pdf filename may be attacker-supplied. This a