doc: avoid Python injection if filenames contain quotes

Signed-off-by: Simon McVittie <smcv@collabora.com>

diff --git a/doc/Makefile.am b/doc/Makefile.am
index 5fe9b190922af90788345a7a8bf054fae30bda6d..315c93495e557c03a7f63643a700ec6a66cca6b0 100644 (file)
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -224,6 +224,7 @@ clean-local:
        rm -f *.1.html
        rm -f doxygen.stamp
 
+EXTRA_DIST += list-doc-source.py
 EXTRA_DIST += maintainer-upload-docs.sh
 EXTRA_DIST += meson.build
 EXTRA_DIST += meson_post_install.py

diff --git a/doc/list-doc-source.py b/doc/list-doc-source.py
new file mode 100644 (file)
index 0000000..2ed442c
--- /dev/null
+++ b/doc/list-doc-source.py
@@ -0,0 +1,9 @@
+#!/usr/bin/env python3
+# Copyright © 2019-2020 Salamandar <felix@piedallu.me>
+# Copyright 2022 Collabora Ltd.
+# SPDX-License-Identifier: MIT
+
+import glob
+import sys
+
+print('\n'.join(glob.glob(sys.argv[1] + '/*.[ch]')))

diff --git a/doc/meson.build b/doc/meson.build
index f7184791dfcc7cade0b1a4617a36530a27155a06..3b97f4bd8e79785ca21f415c362abc8cab7a4db2 100644 (file)
--- a/doc/meson.build
+++ b/doc/meson.build
@@ -176,9 +176,10 @@ if doxygen.found()
 
     dbus_srcs = run_command(
         python,
-        '-c',
-        '''from glob import glob;print('\n'.join(glob('@0@/*.[ch]')))'''.format(meson.project_source_root() / 'dbus'),
-        check: true).stdout().strip().split('\n')
+        files('list-doc-source.py'),
+        meson.project_source_root() / 'dbus',
+        check: true
+    ).stdout().strip().split('\n')
     dbus_srcs += dbus_arch_deps_h
 
     doxygen_tgt = custom_target('doxygen',