[LyX/2.5.x] Hardening case 00a - arbitrary command execution via kpsewhich filename

commit 6b1869fdd9f123dfbf72287a801429038f38244b
Author: Pavel Sanda <[email protected]>
Date:   Thu Jun 4 13:20:02 2026 +0200

    Hardening case 00a - arbitrary command execution via kpsewhich filename
    
    findtexfile() runs ("kpsewhich " + fil) directly through shell without
    sanitization of fil. That leaves it open to arbitrary commands injected
    as filenames inside .lyx file.
    
    Fires on .lyx load + export.
    
    Tier 00 hotfix: pass fil quoted and after a "--" separator.
    Tier 01 DiD will land in master (argv-form kpsewhich).
    
    Assisted-by: Claude Opus 4.7
---
 src/support/filetools.cpp | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/support/filetools.cpp b/src/support/filetools.cpp
index e0dc4e7654..823ff78728 100644
--- a/src/support/filetools.cpp
+++ b/src/support/filetools.cpp
@@ -1227,7 +1227,22 @@ FileName const findtexfile(string const & fil, string const & /*format*/,
 	// tfm - TFMFONTS, TEXFONTS
 	// This means that to use kpsewhich in the best possible way we
 	// should help it by setting additional path in the approp. envir.var.
-	string const kpsecmd = "kpsewhich " + fil;
+
+	if (fil.empty())
+		return FileName();
+
+	// Wrap fil in the shell's quoting form that disables the relevant
+	// metacharacter set.
+#ifdef _WIN32
+	// Reject '"' in filename, can't be backslashed & forbidden by NTFS anyway
+	if (fil.find('"') != string::npos)
+		return FileName();
+	// disable metacharacters
+	string const kpsecmd = "kpsewhich -- \"" + fil + "\"";
+#else
+	// disable metacharacters & escape existing '
+	string const kpsecmd = "kpsewhich -- '" + subst(fil, "'", "'\\''") + "'";
+#endif
 
 	cmd_ret const c = runCommand(kpsecmd);
 
-- 
lyx-cvs mailing list
[email protected]
https://lists.lyx.org/mailman/listinfo/lyx-cvs