Bug 3927 - TLDC crashes when fed poorly escaped/quoted command strings
Summary: TLDC crashes when fed poorly escaped/quoted command strings
Status: NEW
Alias: None
Product: ThinLinc
Classification: Unclassified
Component: TLDC (Desktop Customizer) (show other bugs)
Version: 3.2.0
Hardware: PC Unknown
: P2 Normal
Target Milestone: LowPrio
Assignee: Pierre Ossman
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-08-03 15:56 CEST by Aaron Sowry
Modified: 2017-06-27 13:43 CEST (History)
0 users

See Also:
Acceptance Criteria:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Aaron Sowry cendio 2011-08-03 15:56:08 CEST 
To reproduce:

1) Create new manual application in TLDC
2) Select "Command to execute on ThinLinc server" and enter, for example, some string that ends in a single double-quote.
3) Hit save

This only happens for UNIX commands; Windows escaping seems to have been taken care of properly.
Comment 1 Aaron Sowry cendio 2011-08-03 15:56:37 CEST 
Traceback:

2011-08-03 14:59:29 ERROR tlwebadm: ----------------------------------------
2011-08-03 14:59:29 ERROR tlwebadm: Traceback (most recent call last):
2011-08-03 14:59:29 ERROR tlwebadm:   File "/opt/thinlinc/sbin/tlwebadm", line
204, in do_POST
2011-08-03 14:59:29 ERROR tlwebadm:     headers , page = module . do_POST (
page_name , query , headers )
2011-08-03 14:59:29 ERROR tlwebadm:   File
"/opt/thinlinc/modules/thinlinc/tlwebadm/main.py", line 82, in do_POST
2011-08-03 14:59:29 ERROR tlwebadm:     page = self . _POST_methods . get (
method , self . error_404 ) ( query )
2011-08-03 14:59:29 ERROR tlwebadm:   File
"/opt/thinlinc/modules/thinlinc/tlwebadm/desktop.py", line 105, in
manapplications
2011-08-03 14:59:29 ERROR tlwebadm:     return self . applications ( query ,
sysapps = False )
2011-08-03 14:59:29 ERROR tlwebadm:   File
"/opt/thinlinc/modules/thinlinc/tlwebadm/desktop.py", line 135, in applications
2011-08-03 14:59:29 ERROR tlwebadm:     ( search_list [ 'errors' ] ,
search_list [ 'details' ] ) = self . save_application ( query )
2011-08-03 14:59:29 ERROR tlwebadm:   File
"/opt/thinlinc/modules/thinlinc/tlwebadm/desktop.py", line 440, in
save_application
2011-08-03 14:59:29 ERROR tlwebadm:     de . setExecArgv ( Oo0O ( details [
'cmd' ] ) )
2011-08-03 14:59:29 ERROR tlwebadm:   File
"/opt/thinlinc/modules/thinlinc/tlwebadm/desktop.py", line 1392, in Oo0O
2011-08-03 14:59:29 ERROR tlwebadm:     return shlex . split ( shell . replace
( '%' , '%%' ) )
2011-08-03 14:59:29 ERROR tlwebadm:   File "/usr/lib64/python2.6/shlex.py",
line 279, in split
2011-08-03 14:59:29 ERROR tlwebadm:     return list(lex)
2011-08-03 14:59:29 ERROR tlwebadm:   File "/usr/lib64/python2.6/shlex.py",
line 269, in next
2011-08-03 14:59:29 ERROR tlwebadm:     token = self.get_token()
2011-08-03 14:59:29 ERROR tlwebadm:   File "/usr/lib64/python2.6/shlex.py",
line 96, in get_token
2011-08-03 14:59:29 ERROR tlwebadm:     raw = self.read_token()
2011-08-03 14:59:29 ERROR tlwebadm:   File "/usr/lib64/python2.6/shlex.py",
line 172, in read_token
2011-08-03 14:59:29 ERROR tlwebadm:     raise ValueError, "No closing
quotation"
2011-08-03 14:59:29 ERROR tlwebadm: ValueError: No closing quotation
2011-08-03 14:59:29 ERROR tlwebadm: ----------------------------------------
Note You need to log in before you can comment on or make changes to this bug.