>From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Pavel Sanda Date: Thu, 4 Jun 2026 13:20:02 +0200 Subject: [PATCH] Hardening case 00a - arbitrary command execution via kpsewhich filename findtexfile() runs ("kpsewhich " + fil) directly through shell without sanitization of fil. That leaves it open to arbitrary commands injected as filenames inside .lyx file. Fires on .lyx load + export. Tier 00 hotfix: pass fil quoted and after a "--" separator. Tier 01 DiD will land in master (argv-form kpsewhich). Assisted-by: Claude Opus 4.7 --- src/support/filetools.cpp | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/src/support/filetools.cpp b/src/support/filetools.cpp index e0dc4e7654..823ff78728 100644 --- a/src/support/filetools.cpp +++ b/src/support/filetools.cpp @@ -1227,7 +1227,22 @@ FileName const findtexfile(string const & fil, string const & /*format*/, // tfm - TFMFONTS, TEXFONTS // This means that to use kpsewhich in the best possible way we // should help it by setting additional path in the approp. envir.var. - string const kpsecmd = "kpsewhich " + fil; + + if (fil.empty()) + return FileName(); + + // Wrap fil in the shell's quoting form that disables the relevant + // metacharacter set. +#ifdef _WIN32 + // Reject '"' in filename, can't be backslashed & forbidden by NTFS anyway + if (fil.find('"') != string::npos) + return FileName(); + // disable metacharacters + string const kpsecmd = "kpsewhich -- \"" + fil + "\""; +#else + // disable metacharacters & escape existing ' + string const kpsecmd = "kpsewhich -- '" + subst(fil, "'", "'\\''") + "'"; +#endif cmd_ret const c = runCommand(kpsecmd); -- 2.39.5