Commit be3c71fa authored by Dave Reisner's avatar Dave Reisner Committed by Pierre Schmitz
Browse files

avoid injecting code into the format string 

Now that die() properly forwards arguments to error(), we can expect
that the first arg is a format string and not the entirety of the
output.

Signed-off-by: default avatarDave Reisner <dreisner@archlinux.org>
Signed-off-by: default avatarPierre Schmitz <pierre@archlinux.de>
parent fb30cabe

arch-nspawn.in

+2 −2
Changes for arch-nspawn.in: 2 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -88,9 +88,9 @@ umask 0022 


# Sanity check

if [[ ! -f "$working_dir/.arch-chroot" ]]; then

	die "'$working_dir' does not appear to be a Arch chroot."

	die "'%s' does not appear to be a Arch chroot." "$working_dir"

elif [[ $(cat "$working_dir/.arch-chroot") != $CHROOT_VERSION ]]; then

	die "chroot '$working_dir' is not at version $CHROOT_VERSION. Please rebuild."

	die "chroot '%s' is not at version %s. Please rebuild." "$working_dir" "$CHROOT_VERSION"

fi



build_mount_args

archco.in

+1 −1
Changes for archco.in: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -15,7 +15,7 @@ case $scriptname in 
	communityco)

		SVNURL="svn+ssh://svn-community@nymeria.archlinux.org/srv/repos/svn-community/svn";;

	*)

		die "Couldn't find svn url for $scriptname"

		die "Couldn't find svn url for %s" "$scriptname"

		;;

esac

archrelease.in

+3 −3
Changes for archrelease.in: 3 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -8,8 +8,8 @@ FORCE= 
while getopts ':f' flag; do

	case $flag in

		f) FORCE=1 ;;

		:) die "Option requires an argument -- '$OPTARG'" ;;

		\?) die "Invalid option -- '$OPTARG'" ;;

		:) die "Option requires an argument -- '%s'" "$OPTARG" ;;

		\?) die "Invalid option -- '%s'" "$OPTARG" ;;

	esac

done

shift $(( OPTIND - 1 ))
@@ -23,7 +23,7 @@ fi 
if [[ -z $FORCE ]]; then

	for tag in "$@"; do

		if ! in_array "$tag" "${_tags[@]}"; then

			die 'archrelease: Invalid tag: "'$tag'" (use -f to force release)'

			die "archrelease: Invalid tag: '%s' (use -f to force release)" "$tag"

		fi

	done

fi

checkpkg.in

+2 −2
Changes for checkpkg.in: 2 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -41,13 +41,13 @@ for _pkgname in "${pkgname[@]}"; do 
	pkgurl=$(pacman -Spdd --print-format '%l' --noconfirm "$_pkgname")



	if [[ $? -ne 0 ]]; then

		die "Couldn't download previous package for $_pkgname."

		die "Couldn't download previous package for %s." "$_pkgname"

	fi



	oldpkg=${pkgurl##*://*/}



	if [[ ${oldpkg##*/} = ${pkgfile##*/} ]]; then

		die "The built package ($_pkgname) is the one in the repo right now!"

		die "The built package (%s) is the one in the repo right now!" "$_pkgname"

	fi



	if [[ ! -f $oldpkg ]]; then

commitpkg.in

+5 −5
Changes for commitpkg.in: 5 added lines, 5 removed lines.
Original line number Diff line number Diff line
@@ -58,7 +58,7 @@ esac 
# check if all local source files are under version control

for s in "${source[@]}"; do

	if [[ $s != *://* ]] && ! svn status -v "$s@" | grep -q '^[ AMRX~]'; then

		die "$s is not under version control"

		die "%s is not under version control" "$s"

	fi

done
@@ -68,7 +68,7 @@ for i in 'changelog' 'install'; do 
		# evaluate any bash variables used

		eval file=\"$(sed 's/^\(['\''"]\)\(.*\)\1$/\2/' <<< "$file")\"

		if ! svn status -v "${file}" | grep -q '^[ AMRX~]'; then

			die "${file} is not under version control"

			die "%s is not under version control" "$file"

		fi

	done < <(sed -n "s/^[[:space:]]*$i=//p" PKGBUILD)

done
@@ -81,8 +81,8 @@ while getopts ':l:a:s:f' flag; do 
		s) server=$OPTARG ;;

		l) rsyncopts+=("--bwlimit=$OPTARG") ;;

		a) commit_arch=$OPTARG ;;

		:) die "Option requires an argument -- '$OPTARG'" ;;

		\?) die "Invalid option -- '$OPTARG'" ;;

		:) die "Option requires an argument -- '%s'" "$OPTARG" ;;

		\?) die "Invalid option -- '%s'" "$OPTARG" ;;

	esac

done

shift $(( OPTIND - 1 ))
@@ -164,7 +164,7 @@ for _arch in ${arch[@]}; do 
			gpg --detach-sign --use-agent ${SIGNWITHKEY} "${pkgfile}" || die

		fi

		if ! gpg --verify "$sigfile" >/dev/null 2>&1; then

			die "Signature ${pkgfile}.sig is incorrect!"

			die "Signature %s.sig is incorrect!" "$pkgfile"

		fi

		uploads+=("$sigfile")

	done