Getting a double-quote in a Caller*ID value causes problems.

From Lee:
| commit 91d837f7f0f4a6bff9a9c08b81dddc4eee3714c6
| Author: faxguy <faxguy@5505949e-d877-4686-9e03-c53b7a51b376>
| Date:   Fri Nov 24 13:27:42 2006 +0000
|
|     Getting a double-quote in a Caller*ID value causes problems.
|
|     Furthermore, it poses a risk for Caller*ID doing mischevious things.
|
|     So I'm changing the quote/enquote to ticks instead of double-quotes and then
|     parsing through all quoted strings and coping with any ticks that appear.
|
|
|    git-svn-id: https://svn.code.sf.net/p/hylafax/HylaFAX+@1503 5505949e-d877-4686-9e03-c53b7a51b376

diff --git a/faxd/faxApp.c++ b/faxd/faxApp.c++
index fd99008d5ce9ab5f4dfec67184e9595ba83c1422..3d53ba580f0a9e431e2c4f7c4b8928e9c50f7624 100644 (file)
--- a/faxd/faxApp.c++
+++ b/faxd/faxApp.c++
@@ -388,8 +388,19 @@ detachIO(void)
            (void) Sys::close(fd);
 }
 
-const fxStr faxApp::quote      = " \"";
-const fxStr faxApp::enquote    = "\"";
+const fxStr faxApp::quote      = " \'";
+const fxStr faxApp::enquote    = "\'";
+
+fxStr
+faxApp::quoted(const fxStr& s)
+{
+    fxStr q;
+    for (u_int i = 0; i < s.length(); i++) {
+       if (s[i] == '\'') q.append("\'\\\'");
+       q.append(s[i]);
+    }
+    return (q);
+}
 
 /*
  * Run the specified shell command.  If changeIDs is

diff --git a/faxd/faxApp.h b/faxd/faxApp.h
index b72c67c294a6c93e71a6fc89a5a968ca66ce6547..fcafed6fc2b58b7d7f86afcd6b52b0b7df14fdd3 100644 (file)
--- a/faxd/faxApp.h
+++ b/faxd/faxApp.h
@@ -79,6 +79,7 @@ public:
 
     static const fxStr quote;
     static const fxStr enquote;
+    fxStr  quoted(const fxStr& s);
 
     static bool runCmd(const char* cmd, bool changeIDs = false, IOHandler* waiter = NULL);
 };

diff --git a/faxd/faxGettyApp.c++ b/faxd/faxGettyApp.c++
index aa7cd36e2411214f1485b3057b45f99b9e970fa7..1bf96bb50d19c0afa5960d9218362316a4192e85 100644 (file)
--- a/faxd/faxGettyApp.c++
+++ b/faxd/faxGettyApp.c++
@@ -337,13 +337,13 @@ faxGettyApp::answerPhone(AnswerType atype, CallType ctype, const CallID& callid,
     rejectCall = false;
 
     for (u_int i = 0; i < callid.size(); i++)
-       callid_formatted.append(quote | callid.id(i) | enquote);
+       callid_formatted.append(quote | quoted(callid.id(i)) | enquote);
 
     if (callid_formatted.length())
        traceProtocol("CallID:%s", (const char*) callid_formatted);
 
     if (dynamicConfig.length()) {
-       fxStr cmd(dynamicConfig | quote | getModemDevice() | enquote | callid_formatted);
+       fxStr cmd(dynamicConfig | quote | quoted(getModemDevice()) | enquote | callid_formatted);
        traceServer("DynamicConfig: %s", (const char*)cmd);
        fxStr localid = "";
        int pipefd[2], status;
@@ -846,14 +846,14 @@ faxGettyApp::notifyRecvDone(FaxRecvInfo& ri)
 
     fxStr callid_formatted;
     for (u_int i = 0; i < ri.callid.size(); i++) {
-       callid_formatted.append(quote | ri.callid.id(i) | enquote);
+       callid_formatted.append(quote | quoted(ri.callid.id(i)) | enquote);
     }
     // hand to delivery/notification command
     fxStr cmd(faxRcvdCmd
-       | quote |             ri.qfile  | enquote
-       | quote |   getModemDeviceID()  | enquote
-       | quote |            ri.commid  | enquote
-       | quote |            ri.reason  | enquote
+       | quote |             quoted(ri.qfile)  | enquote
+       | quote |   quoted(getModemDeviceID())  | enquote
+       | quote |            quoted(ri.commid)  | enquote
+       | quote |            quoted(ri.reason)  | enquote
        | callid_formatted);
     traceServer("RECV FAX: %s", (const char*) cmd);
     setProcessPriority(BASE);                  // lower priority

diff --git a/faxd/faxQCleanApp.c++ b/faxd/faxQCleanApp.c++
index 14bfc8372f6bab301461ac6760b9c42c3eb090f5..b22a010c967c9b84b3b3492bdb97a157f92ac783 100644 (file)
--- a/faxd/faxQCleanApp.c++
+++ b/faxd/faxQCleanApp.c++
@@ -249,7 +249,7 @@ faxQCleanApp::archiveJob(const FaxRequest& req)
 {
     // hand the archiving task off to the archiving command
     fxStr cmd("bin/archive"
-       | quote |             req.jobid | enquote
+       | quote |             quoted(req.jobid) | enquote
     );
     runCmd(cmd, true);
 }

diff --git a/faxd/faxQueueApp.c++ b/faxd/faxQueueApp.c++
index 3b5659147f7909157ea7dcdec5ba0d582c9d54d6..9b2e12680a7b13fb7cef3d6bccea63e0c925d0ea 100644 (file)
--- a/faxd/faxQueueApp.c++
+++ b/faxd/faxQueueApp.c++
@@ -3186,8 +3186,8 @@ faxQueueApp::notifyModemWedged(Modem& modem)
     fxStr dev(idToDev(modem.getDeviceID()));
     logError("MODEM %s appears to be wedged", (const char*)dev);
     fxStr cmd(wedgedCmd
-       | quote |  modem.getDeviceID() | enquote
-       | quote |                  dev | enquote
+       | quote | quoted(modem.getDeviceID()) | enquote
+       | quote |                 quoted(dev) | enquote
     );
     traceServer("MODEM WEDGED: %s", (const char*) cmd);
     runCmd(cmd, true, this);
@@ -3693,9 +3693,9 @@ void
 faxQueueApp::notifySender(Job& job, JobStatus why, const char* duration)
 {
     fxStr cmd(notifyCmd
-       | quote |                job.file | enquote
-       | quote | Job::jobStatusName(why) | enquote
-       | quote |                duration | enquote
+       | quote |                quoted(job.file) | enquote
+       | quote | quoted(Job::jobStatusName(why)) | enquote
+       | quote |                quoted(duration) | enquote
     );
     if (why == Job::requeued) {
        /*

diff --git a/faxd/faxSendApp.c++ b/faxd/faxSendApp.c++
index 68406ff6f9c7c4fe21010af5e61c04d4efa3db6f..2f2d5e93f2d6d18a71d9edb3adce7270ea7bf5de 100644 (file)
--- a/faxd/faxSendApp.c++
+++ b/faxd/faxSendApp.c++
@@ -359,11 +359,11 @@ faxSendApp::notifyPollRecvd(FaxRequest& req, FaxRecvInfo& ri)
 
     // hand to delivery/notification command
     fxStr cmd(pollRcvdCmd
-        | quote |       req.mailaddr | enquote
-        | quote |           ri.qfile | enquote
-        | quote | getModemDeviceID() | enquote
-        | quote |          ai.commid | enquote
-        | quote |          ri.reason | enquote
+        | quote |       quoted(req.mailaddr) | enquote
+        | quote |           quoted(ri.qfile) | enquote
+        | quote | quoted(getModemDeviceID()) | enquote
+        | quote |          quoted(ai.commid) | enquote
+        | quote |          quoted(ri.reason) | enquote
      );
     traceServer("RECV POLL: %s", (const char*) cmd);
     setProcessPriority(BASE);                  // lower priority