Permalink
Browse files

0.91-fixes: Fixed minor security hole in compile-messages.py. See tru…

…nk patch in [3592]

git-svn-id: http://code.djangoproject.com/svn/django/branches/0.91-bugfixes@3593 bcc190cf-cafb-0310-a4f2-bffc1f526a37
  • Loading branch information...
1 parent 0d60669 commit d31e39173c29537e6a1613278c93634c18a3206e @ubernostrum ubernostrum committed Aug 16, 2006
Showing with 8 additions and 1 deletion.
  1. +8 −1 django/bin/compile-messages.py
@@ -20,7 +20,14 @@ def compile_messages():
if f.endswith('.po'):
sys.stderr.write('processing file %s in %s\n' % (f, dirpath))
pf = os.path.splitext(os.path.join(dirpath, f))[0]
- cmd = 'msgfmt -o "%s.mo" "%s.po"' % (pf, pf)
+ # Store the names of the .mo and .po files in an environment
+ # variable, rather than doing a string replacement into the
+ # command, so that we can take advantage of shell quoting, to
+ # quote any malicious characters/escaping.
+ # See http://cyberelk.net/tim/articles/cmdline/ar01s02.html
+ os.environ['djangocompilemo'] = pf + '.mo'
+ os.environ['djangocompilepo'] = pf + '.po'
+ cmd = 'msgfmt -o "$djangocompilemo" "$djangocompilepo"'
os.system(cmd)
if __name__ == "__main__":

0 comments on commit d31e391

Please sign in to comment.