[LyX/2.5.x] Hardening case 00b - arbitrary command execution via lyx2lyx invocation

commit b7ad8f29891233891a6c512e9578162bc74031ac
Author: Pavel Sanda <[email protected]>
Date:   Thu Jun 4 13:20:02 2026 +0200

    Hardening case 00b - arbitrary command execution via lyx2lyx invocation
    
    convertLyXFormat() builds the lyx2lyx command as a shell string and passes
    the filenames through quoteName(), which leaves active characters alive.
    Crafted filename on an old-format .lyx injects arbitrary commands.
    
    Fires on .lyx load (old-format file needing conversion).
    
    Tier 00 hotfix: single-quote the filename args on POSIX, keep quoteName on Windows.
    Tier 01 DiD will land in master (argv-form lyx2lyx).
    
    Assisted-by: Claude Opus 4.7
---
 src/Buffer.cpp | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/src/Buffer.cpp b/src/Buffer.cpp
index 2ea6125e06..18a0279e2d 100644
--- a/src/Buffer.cpp
+++ b/src/Buffer.cpp
@@ -1402,12 +1402,22 @@ Buffer::ReadStatus Buffer::convertLyXFormat(FileName const & fn,
 
 	// Run lyx2lyx:
 	//   $python$ "$lyx2lyx$" -t $LYX_FORMAT$ -o "$tempfile$" "$filetoread$"
+
+	// guard against command expansion in filename strings on linux,
+	// keep " on windows
+	auto sh_quote = [](string const & s) -> string {
+#ifdef _WIN32
+		return quoteName(s);
+#else
+		return '\'' + subst(s, "'", "'\\''") + '\'';
+#endif
+	};
 	ostringstream command;
 	command << os::python()
-		<< ' ' << quoteName(lyx2lyx.toFilesystemEncoding())
+		<< ' ' << sh_quote(lyx2lyx.toFilesystemEncoding())
 		<< " -t " << convert<string>(LYX_FORMAT)
-		<< " -o " << quoteName(tmpfile.toSafeFilesystemEncoding())
-		<< ' ' << quoteName(fn.toSafeFilesystemEncoding());
+		<< " -o " << sh_quote(tmpfile.toSafeFilesystemEncoding())
+		<< ' ' << sh_quote(fn.toSafeFilesystemEncoding());
 	string const command_str = command.str();
 
 	LYXERR(Debug::INFO, "Running '" << command_str << '\'');
-- 
lyx-cvs mailing list
[email protected]
https://lists.lyx.org/mailman/listinfo/lyx-cvs