isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

For "sudo -l", if a word includes spaces, print it in double quotes.

Browse Source 
Also escape spaces in the command path.  This matches the sudoers
quoting rules.
This commit is contained in:
Todd C. Miller
2018-02-03 06:59:37 -07:00
parent 40c200af18
commit 105ced47b8
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
plugins/sudoers/parse.c
View File

@@ -1,5 +1,5 @@
/* /*
* Copyright (c) 2004-2005, 2007-2017 Todd C. Miller <Todd.Miller@sudo.ws> * Copyright (c) 2004-2005, 2007-2018 Todd C. Miller <Todd.Miller@sudo.ws>
* *
* Permission to use, copy, modify, and distribute this software for any * Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above * purpose with or without fee is hereby granted, provided that the above
@@ -863,7 +863,7 @@ print_member_int(struct sudo_lbuf *lbuf, char *name, int type, int negated,
c = (struct sudo_command *) name; c = (struct sudo_command *) name;
if (negated) if (negated)
sudo_lbuf_append(lbuf, "!"); sudo_lbuf_append(lbuf, "!");
sudo_lbuf_append_quoted(lbuf, SUDOERS_QUOTED, "%s", c->cmnd); sudo_lbuf_append_quoted(lbuf, SUDOERS_QUOTED" \t", "%s", c->cmnd);
if (c->args) { if (c->args) {
sudo_lbuf_append(lbuf, " "); sudo_lbuf_append(lbuf, " ");
sudo_lbuf_append_quoted(lbuf, SUDOERS_QUOTED, "%s", c->args); sudo_lbuf_append_quoted(lbuf, SUDOERS_QUOTED, "%s", c->args);
@@ -888,8 +888,14 @@ print_member_int(struct sudo_lbuf *lbuf, char *name, int type, int negated,
name[strspn(name + 1, "0123456789") + 1] == '\0') { name[strspn(name + 1, "0123456789") + 1] == '\0') {
sudo_lbuf_append(lbuf, "%s%s", negated ? "!" : "", name); sudo_lbuf_append(lbuf, "%s%s", negated ? "!" : "", name);
} else { } else {
sudo_lbuf_append_quoted(lbuf, SUDOERS_QUOTED, "%s%s", if (strpbrk(name, " \t") != NULL) {
negated ? "!" : "", name); sudo_lbuf_append(lbuf, "%s\"", negated ? "!" : "");
sudo_lbuf_append_quoted(lbuf, "\"", "%s", name);
sudo_lbuf_append(lbuf, "\"");
} else {
sudo_lbuf_append_quoted(lbuf, SUDOERS_QUOTED, "%s%s",
negated ? "!" : "", name);
}
} }
break; break;
} }