From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id CFA3A15807A for ; Sat, 07 Jun 2025 22:55:16 +0000 (UTC) Received: from lists.gentoo.org (bobolink.gentoo.org [140.211.166.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) (Authenticated sender: relay-lists.gentoo.org@gentoo.org) by smtp.gentoo.org (Postfix) with ESMTPSA id BD39A343060 for ; Sat, 07 Jun 2025 22:55:16 +0000 (UTC) Received: from bobolink.gentoo.org (localhost [127.0.0.1]) by bobolink.gentoo.org (Postfix) with ESMTP id 08ECC1104B8; Sat, 07 Jun 2025 22:54:50 +0000 (UTC) Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by bobolink.gentoo.org (Postfix) with ESMTPS id 011A71104B8 for ; Sat, 07 Jun 2025 22:54:49 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id AB92E3430CF for ; Sat, 07 Jun 2025 22:54:49 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 564A32976 for ; Sat, 07 Jun 2025 22:54:46 +0000 (UTC) From: "Sam James" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sam James" Message-ID: <1749336852.a722142b8676a46c432e77133ec97d802edd1845.sam@gentoo> Subject: [gentoo-commits] proj/portage:master commit in: bin/ X-VCS-Repository: proj/portage X-VCS-Files: bin/ecompress X-VCS-Directories: bin/ X-VCS-Committer: sam X-VCS-Committer-Name: Sam James X-VCS-Revision: a722142b8676a46c432e77133ec97d802edd1845 X-VCS-Branch: master Date: Sat, 07 Jun 2025 22:54:46 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: 048d27e6-9d17-4af7-b435-9b6bddec3450 X-Archives-Hash: 8923f80bdddfba3b06045ef1a75cbfce commit: a722142b8676a46c432e77133ec97d802edd1845 Author: Kerin Millar plushkava net> AuthorDate: Sat Jun 7 11:55:12 2025 +0000 Commit: Sam James gentoo org> CommitDate: Sat Jun 7 22:54:12 2025 +0000 URL: https://gitweb.gentoo.org/proj/portage.git/commit/?id=a722142b ecompress: safely split the PORTAGE_COMPRESS{,FLAGS} variables Presently, the guest_suffix() function attempts to execute a simple command through the unquoted expansion of both the 'PORTAGE_COMPRESS' and 'PORTAGE_COMPRESS_FLAGS' variables. This renders it sensitive to the prevailing value of IFS, and runs the risk of performing pathname expansion on the resulting words. Address the issue by using read to safely separate the collected words into an array, and by expanding the array as a simple command. Signed-off-by: Kerin Millar plushkava.net> Signed-off-by: Sam James gentoo.org> bin/ecompress | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/bin/ecompress b/bin/ecompress index 2b7bca1629..107bf36d42 100755 --- a/bin/ecompress +++ b/bin/ecompress @@ -102,7 +102,8 @@ do_queue() { } guess_suffix() { - local f i suffix tmpdir + local IFS f i suffix tmpdir + local -a cmd trap 'rm -rf -- "${tmpdir}"' RETURN @@ -118,7 +119,8 @@ guess_suffix() { printf '%s ' "${i}" || ! break done > compressme || return - ${PORTAGE_COMPRESS} ${PORTAGE_COMPRESS_FLAGS} compressme > /dev/null || return + read -rd '' -a cmd <<<"${PORTAGE_COMPRESS} ${PORTAGE_COMPRESS_FLAGS}" + "${cmd[@]}" compressme > /dev/null || return # If PORTAGE_COMPRESS_FLAGS contains -k then we need to avoid # having our glob match the uncompressed file here.