[LyX/2.5.x] Hardening case 00d - arbitrary command execution via bibtex_command

commit 7df0b9dc587d18b9d3826d60541d089c8dee9cd5
Author: Pavel Sanda <[email protected]>
Date:   Thu Jul 16 19:06:25 2026 +0200

    Hardening case 00d - arbitrary command execution via bibtex_command
    
    A document-set \bibtex_command reaches two sinks:
    - the preview pipeline, where --bibtex= feeds lyxpreview_tools.py,
    - the export bibtex call, where parsecmd extracts <> redirection (file overwrite)
      (and/or injects code via metachars - win only).
    
    Fires on export and on instant preview of a citation (possibly just load).
    
    Tier 00 hotfix: drop --bibtex= from the preview; reject the redirection/metas.
    Tier 01 DiD will land in master (canonical split).
    Tier 02 strings will land in later 2.5.x (prefs hint).
    
    Assisted-by: Claude Opus 4.8
---
 src/BufferParams.cpp           | 22 ++++++++++++++++++++--
 src/graphics/PreviewLoader.cpp |  7 ++++++-
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/src/BufferParams.cpp b/src/BufferParams.cpp
index cb14f20aba..05f5f149d0 100644
--- a/src/BufferParams.cpp
+++ b/src/BufferParams.cpp
@@ -4498,8 +4498,26 @@ string const BufferParams::getBibtexCommand(string const & cmd, bool const warn)
 string const BufferParams::bibtexCommand(bool const warn) const
 {
 	// Return document-specific setting if available
-	if (bibtex_command != "default")
-		return getBibtexCommand(bibtex_command, warn);
+	if (bibtex_command != "default") {
+
+		// Block redirection on the export bibtex call.
+		// Temporary hotfix, longterm solution needs structural
+		// split between program and options.
+		//
+		// Windows need wider set as it sinks to shell (unlike linux/mac).
+#if defined(_WIN32)
+		static char const * const SUSPECT_CHARS = "<>\"\\\t\n" "&|()^%;";
+#else
+		static char const * const SUSPECT_CHARS = "<>\"\\\t\n";
+#endif
+		if (bibtex_command.find_first_of(SUSPECT_CHARS) == string::npos)
+			return getBibtexCommand(bibtex_command, warn);
+		if (warn)
+			frontend::Alert::warning(
+				_("Requested bibliography command rejected"),
+				_("The bibliography processor command contains prohibited characters."));
+		// fall through to the lyxrc-driven selection below
+	}
 
 	// If we have "default" in document settings, consult the prefs
 	// 1. Japanese (uses a specific processor)
diff --git a/src/graphics/PreviewLoader.cpp b/src/graphics/PreviewLoader.cpp
index 25dcb2fd61..7824270cce 100644
--- a/src/graphics/PreviewLoader.cpp
+++ b/src/graphics/PreviewLoader.cpp
@@ -685,7 +685,12 @@ void PreviewLoader::Impl::startLoading(bool wait)
 	}
 
 	cs << latexparam;
-	cs << " --bibtex=" << quoteName(buffer_.params().bibtexCommand());
+
+	// --bibtex= allows document-controlled arbitrary code
+	// execution in lyxpreview_tools.py. Tradeoff when disabling
+	// it is unresolved citations inside math/ERT preview.
+	//cs << " --bibtex=" << quoteName(buffer_.params().bibtexCommand());
+
 	if (buffer_.params().bufferFormat() == "lilypond-book")
 		cs << " --lilypond";
 
-- 
lyx-cvs mailing list
[email protected]
https://lists.lyx.org/mailman/listinfo/lyx-cvs