Block tty control codes in untrusted mr config files.

[code/myrepos.git] / mr

diff --git a/mr b/mr
index 3996b60622e4a6433c4737c48584a261893631d2..6e27cd5ee0e59b16d67acb21b788cef479b9dac2 100755 (executable)
--- a/mr
+++ b/mr
@@ -1184,6 +1184,11 @@ sub loadconfig {
                $_=shift @lines;
                $line++;
                chomp;
+
+               if (! $trusted && /[[:cntrl:]]/) {
+                       trusterror("mr: illegal control character", $f, $line, $bootstrap_url);
+               }
+
                next if /^\s*\#/ || /^\s*$/;
                if (/^\[([^\]]*)\]\s*$/) {
                        $section=$1;