map: disallow commands with \n

Control protocol uses \n as command delimiter so we cannot allow \n
inside commands. Users should be able to Lua-escape \n with \010.

diff --git a/daemon/lua/sandbox.lua.in b/daemon/lua/sandbox.lua.in
index e08c69b53896bc025e4a7c72807609c479e8194b..f7c2afd38abc5bb60c7238b3a934f42f6875f4af 100644 (file)
--- a/daemon/lua/sandbox.lua.in
+++ b/daemon/lua/sandbox.lua.in
@@ -744,6 +744,8 @@ function map(cmd, format)
 
        if (type(cmd) ~= 'string') then
                panic('map() command must be a string') end
+       if string.find(cmd, '\n', 1, true) then
+               panic('map() command cannot contain literal \\n, escape it with \\010') end
        if (#cmd <= 0) then
                panic('map() command must be non-empty') end
        -- syntax check on input command to detect typos early