Block tty control codes in untrusted mr config files.

diff --git a/debian/changelog b/debian/changelog
index e7f32b852fe09a5728c5a8bdb1f59fcd5122cfc7..39fa503589ecc7cab57bc60bd148700b5f54c716 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -2,6 +2,7 @@ mr (1.07) UNRELEASED; urgency=low
 
   * Added support for vcsh, enable with: include = cat /usr/share/mr/vcsh
     Thanks, Richard Hartmann 
+  * Block tty control codes in untrusted mr config files.
 
  -- Joey Hess <joeyh@debian.org>  Tue, 29 Nov 2011 18:15:51 -0400
 

diff --git a/mr b/mr
index 3996b60622e4a6433c4737c48584a261893631d2..6e27cd5ee0e59b16d67acb21b788cef479b9dac2 100755 (executable)
--- a/mr
+++ b/mr
@@ -1184,6 +1184,11 @@ sub loadconfig {
                $_=shift @lines;
                $line++;
                chomp;
+
+               if (! $trusted && /[[:cntrl:]]/) {
+                       trusterror("mr: illegal control character", $f, $line, $bootstrap_url);
+               }
+
                next if /^\s*\#/ || /^\s*$/;
                if (/^\[([^\]]*)\]\s*$/) {
                        $section=$1;