From c0d9c4f3ce7bda19081d0da01a599bec067338a3 Mon Sep 17 00:00:00 2001
From: Jo-Philipp Wich <jo@mein.io>
Date: Thu, 5 Apr 2018 09:32:22 +0200
Subject: treewide: filter shell arguments through shellquote() where
 applicable

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
---
 modules/luci-base/luasrc/model/ipkg.lua   | 23 ++++++++++++++---------
 modules/luci-base/luasrc/model/uci.lua    |  2 +-
 modules/luci-base/luasrc/sys.lua          | 23 ++++++++---------------
 modules/luci-base/luasrc/tools/status.lua |  4 +++-
 4 files changed, 26 insertions(+), 26 deletions(-)

(limited to 'modules/luci-base/luasrc')

diff --git a/modules/luci-base/luasrc/model/ipkg.lua b/modules/luci-base/luasrc/model/ipkg.lua
index e653b03465..e27ea52895 100644
--- a/modules/luci-base/luasrc/model/ipkg.lua
+++ b/modules/luci-base/luasrc/model/ipkg.lua
@@ -20,12 +20,14 @@ module "luci.model.ipkg"
 
 -- Internal action function
 local function _action(cmd, ...)
-	local pkg = ""
+	local cmdline = { ipkg, cmd }
+
+	local k, v
 	for k, v in pairs({...}) do
-		pkg = pkg .. " '" .. v:gsub("'", "") .. "'"
+		cmdline[#cmdline+1] = util.shellquote(v)
 	end
 
-	local c = "%s %s %s >/tmp/opkg.stdout 2>/tmp/opkg.stderr" %{ ipkg, cmd, pkg }
+	local c = "%s >/tmp/opkg.stdout 2>/tmp/opkg.stderr" % table.concat(cmdline, " ")
 	local r = os.execute(c)
 	local e = fs.readfile("/tmp/opkg.stderr")
 	local o = fs.readfile("/tmp/opkg.stdout")
@@ -74,17 +76,17 @@ local function _parselist(rawdata)
 end
 
 -- Internal lookup function
-local function _lookup(act, pkg)
-	local cmd = ipkg .. " " .. act
+local function _lookup(cmd, pkg)
+	local cmdline = { ipkg, cmd }
 	if pkg then
-		cmd = cmd .. " '" .. pkg:gsub("'", "") .. "'"
+		cmdline[#cmdline+1] = util.shellquote(pkg)
 	end
 
 	-- OPKG sometimes kills the whole machine because it sucks
 	-- Therefore we have to use a sucky approach too and use
 	-- tmpfiles instead of directly reading the output
 	local tmpfile = os.tmpname()
-	os.execute(cmd .. (" >%s 2>/dev/null" % tmpfile))
+	os.execute("%s >%s 2>/dev/null" %{ table.concat(cmdline, " "), tmpfile })
 
 	local data = _parselist(io.lines(tmpfile))
 	os.remove(tmpfile)
@@ -123,9 +125,12 @@ end
 
 -- List helper
 local function _list(action, pat, cb)
-	local fd = io.popen(ipkg .. " " .. action ..
-		(pat and (" '%s'" % pat:gsub("'", "")) or ""))
+	local cmdline = { ipkg, action }
+	if pat then
+		cmdline[#cmdline+1] = util.shellquote(pat)
+	end
 
+	local fd = io.popen(table.concat(cmdline, " "))
 	if fd then
 		local name, version, sz, desc
 		while true do
diff --git a/modules/luci-base/luasrc/model/uci.lua b/modules/luci-base/luasrc/model/uci.lua
index 3208f3b372..bbd9b4cfbf 100644
--- a/modules/luci-base/luasrc/model/uci.lua
+++ b/modules/luci-base/luasrc/model/uci.lua
@@ -407,7 +407,7 @@ function apply(self, configlist, command)
 		return { "/sbin/luci-reload", unpack(configlist) }
 	else
 		return os.execute("/sbin/luci-reload %s >/dev/null 2>&1"
-			% table.concat(configlist, " "))
+			% util.shellquote(table.concat(configlist, " ")))
 	end
 end
 
diff --git a/modules/luci-base/luasrc/sys.lua b/modules/luci-base/luasrc/sys.lua
index 12b20e4c38..823e20770c 100644
--- a/modules/luci-base/luasrc/sys.lua
+++ b/modules/luci-base/luasrc/sys.lua
@@ -87,10 +87,10 @@ end
 function httpget(url, stream, target)
 	if not target then
 		local source = stream and io.popen or luci.util.exec
-		return source("wget -qO- '"..url:gsub("'", "").."'")
+		return source("wget -qO- %s" % luci.util.shellquote(url))
 	else
-		return os.execute("wget -qO '%s' '%s'" %
-			{target:gsub("'", ""), url:gsub("'", "")})
+		return os.execute("wget -qO %s %s" %
+			{luci.util.shellquote(target), luci.util.shellquote(url)})
 	end
 end
 
@@ -443,18 +443,11 @@ function user.checkpasswd(username, pass)
 end
 
 function user.setpasswd(username, password)
-	if password then
-		password = password:gsub("'", [['"'"']])
-	end
-
-	if username then
-		username = username:gsub("'", [['"'"']])
-	end
-
-	return os.execute(
-		"(echo '" .. password .. "'; sleep 1; echo '" .. password .. "') | " ..
-		"passwd '" .. username .. "' >/dev/null 2>&1"
-	)
+	return os.execute("(echo %s; sleep 1; echo %s) | passwd %s >/dev/null 2>&1" %{
+		luci.util.shellquote(password),
+		luci.util.shellquote(password),
+		luci.util.shellquote(username)
+	})
 end
 
 
diff --git a/modules/luci-base/luasrc/tools/status.lua b/modules/luci-base/luasrc/tools/status.lua
index 1c4038735f..06a9ad4154 100644
--- a/modules/luci-base/luasrc/tools/status.lua
+++ b/modules/luci-base/luasrc/tools/status.lua
@@ -187,7 +187,9 @@ function switch_status(devs)
 	local switches = { }
 	for dev in devs:gmatch("[^%s,]+") do
 		local ports = { }
-		local swc = io.popen("swconfig dev '%s' show" % dev:gsub("'", ""), "r")
+		local swc = io.popen("swconfig dev %s show"
+			% luci.util.shellquote(dev), "r")
+
 		if swc then
 			local l
 			repeat
-- 
cgit v1.2.3