From 27d2c996c39d4fd2f731dd579f77fa37fddf9266 Mon Sep 17 00:00:00 2001
From: Benjamin ter Kuile <bterkuile@gmail.com>
Date: Tue, 15 Jan 2019 10:54:09 -0500
Subject: [PATCH] Escape shellwords for file operations

---
 app/services/dunlop/file_grep.rb |  4 ++--
 app/services/dunlop/file_sed.rb  |  8 ++++----
 app/services/dunlop/file_zip.rb  | 14 +++++++-------
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/app/services/dunlop/file_grep.rb b/app/services/dunlop/file_grep.rb
index 3ab7973..c7ba9c1 100644
--- a/app/services/dunlop/file_grep.rb
+++ b/app/services/dunlop/file_grep.rb
@@ -1,11 +1,11 @@
 module Dunlop::FileGrep
 
   def self.egrep( input_filename, output_filename, regexp )
-    %x[egrep '#{regexp}' #{input_filename} > #{output_filename}]
+    %x[egrep '#{regexp}' #{Shellwords.escape(input_filename)} > #{Shellwords.escape(output_filename)}]
   end
 
   def self.egrep_v( input_filename, output_filename, regexp )
-    %x[egrep -v '#{regexp}' #{input_filename} > #{output_filename}]
+    %x[egrep -v '#{regexp}' #{Shellwords.escape(input_filename)} > #{Shellwords.escape(output_filename)}]
   end
 
   def self.select(input_filename, regexp_string)
diff --git a/app/services/dunlop/file_sed.rb b/app/services/dunlop/file_sed.rb
index 5962576..7f88224 100644
--- a/app/services/dunlop/file_sed.rb
+++ b/app/services/dunlop/file_sed.rb
@@ -4,20 +4,20 @@ module Dunlop::FileSed
     expression_list = Array.wrap(sed_expressions).map { |exp| "-e '#{exp}'" }.join(' ')
     if /Darwin/i =~ %x[uname]
       #BSD
-      %x[ LC_CTYPE=C LANG=C gsed -i'' -r #{expression_list} #{filename} ]
+      %x[ LC_CTYPE=C LANG=C gsed -i'' -r #{expression_list} #{Shellwords.escape(filename)} ]
       raise 'error in sed command line' unless $?.exitstatus == 0
     else
       #GNU
-      %x[ LC_CTYPE=C LANG=C sed -i'' -r #{expression_list} #{filename} ]
+      %x[ LC_CTYPE=C LANG=C sed -i'' -r #{expression_list} #{Shellwords.escape(filename)} ]
       raise 'error in sed command line' unless $?.exitstatus == 0
     end
   end
 
   def self.fix_line_endings(filename)
     return if filename.to_s.end_with?('.xlsx')
-    res = %x[dos2unix -f #{filename} > /dev/null 2>&1]
+    res = %x[dos2unix -f #{Shellwords.escape(filename)} > /dev/null 2>&1]
     raise "error in dos2unix command line (#{res})" unless $?.exitstatus == 0
-    res = %x[dos2unix -f -c mac #{filename} > /dev/null 2>&1]
+    res = %x[dos2unix -f -c mac #{Shellwords.escape(filename)} > /dev/null 2>&1]
     raise "error in dos2unix command line mac (#{res})" unless $?.exitstatus == 0
   end
 
diff --git a/app/services/dunlop/file_zip.rb b/app/services/dunlop/file_zip.rb
index 8f66cef..5831328 100644
--- a/app/services/dunlop/file_zip.rb
+++ b/app/services/dunlop/file_zip.rb
@@ -4,12 +4,12 @@ module Dunlop::FileZip
     case self.mime_type(zipped_filename)
     when "application/zip"
       if zipped_filename.to_s.end_with?('.xlsx') # .xlsx IS a zipfile # .to_s is because it can be a Pathname
-        %x[ cp #{zipped_filename} #{unzipped_filename} ]
+        %x[ cp #{Shellwords.escape(zipped_filename)} #{Shellwords.escape(unzipped_filename)} ]
       else
-        %x[ unzip -p #{zipped_filename} > #{unzipped_filename} ]
+        %x[ unzip -p #{Shellwords.escape(zipped_filename)} > #{Shellwords.escape(unzipped_filename)} ]
       end
     when "application/x-gzip"
-      %x[ gzip -c -d #{zipped_filename} > #{unzipped_filename} ]
+      %x[ gzip -c -d #{Shellwords.escape(zipped_filename)} > #{Shellwords.escape(unzipped_filename)} ]
     when "text/plain"
       FileUtils.cp(zipped_filename, unzipped_filename)
     else
@@ -20,7 +20,7 @@ module Dunlop::FileZip
   def self.unzip_to_directory_and_junk_paths(zipped_filename, destination_directory)
     case self.mime_type(zipped_filename)
     when "application/zip"
-      %x[ unzip -j #{zipped_filename} -d #{destination_directory} ]
+      %x[ unzip -j #{Shellwords.escape(zipped_filename)} -d #{Shellwords.escape(destination_directory)} ]
     else
       raise "unsupported mime-type"
     end
@@ -28,9 +28,9 @@ module Dunlop::FileZip
 
   def self.mime_type(filename)
     command = if /Darwin/i =~ %x[uname]
-      "file -bI #{filename}"
+      "file -bI #{Shellwords.escape(filename)}"
     else
-      "file -bi #{filename}"
+      "file -bi #{Shellwords.escape(filename)}"
     end
 
     case %x[#{command}]
@@ -45,7 +45,7 @@ module Dunlop::FileZip
 
   def self.gzip(unzipped_filename, gzipped_filename)
     return if mime_type(unzipped_filename) == "application/x-gzip" #TODO: maybe the application using is is expecti a copy at the target location in this case?
-    %x[cat #{unzipped_filename} | gzip -c > #{gzipped_filename}]
+    %x[cat #{Shellwords.escape(unzipped_filename)} | gzip -c > #{Shellwords.escape(gzipped_filename)}]
   end
 
 end