dilim/CMake
1
0
Fork 0
mirror of https://github.com/Kitware/CMake.git synced 2026-08-08 16:50:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

file(GLOB): Teach CONFIGURE_DEPENDS to handle quotes in matched file names

Browse Source 
Otherwise a malicious file name can inject code into the verification
script.

Fixes: #28023
This commit is contained in:
Brad King
2026-08-06 09:57:40 -04:00
parent 316bc3346d
commit 9a9ce6637b
5 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
Source/cmGlobVerificationManager.cxx
View File

@@ -11,6 +11,7 @@
#include "cmListFileCache.h"
#include "cmMessageType.h"
#include "cmMessenger.h"
#include "cmOutputConverter.h"
#include "cmStringAlgorithms.h"
#include "cmSystemTools.h"
#include "cmVersion.h"
@@ -64,8 +65,9 @@ bool cmGlobVerificationManager::SaveVerificationScript(const std::string& path,
verifyScriptFile << "\n";
verifyScriptFile << "set(OLD_GLOB\n";
for (const std::string& file : v.Files) {
verifyScriptFile << " \"" << file << "\"\n";
for (std::string const& file : v.Files) {
verifyScriptFile << " " << cmOutputConverter::EscapeForCMake(file)
<< '\n';
}
verifyScriptFile << " )\n";

2
Tests/RunCMake/file/GLOB-CONFIGURE_DEPENDS-RerunCMake-build-stdout.txt
View File

@@ -1 +1 @@
.*b9fbdd8803c036dbe9f5ea6b74db4b9670c78a72
.*(f7e3d5ebf4a6976f057a883301f2066b10bd4cd6|b9fbdd8803c036dbe9f5ea6b74db4b9670c78a72)

2
Tests/RunCMake/file/GLOB-CONFIGURE_DEPENDS-RerunCMake-rebuild_first-stdout.txt
View File

@@ -1,2 +1,2 @@
.*Running CMake on GLOB-CONFIGURE_DEPENDS-RerunCMake
.*6bc141b40c0f851d20fa9a1fe5fbdae94acc5de0
.*(293478329e0cb75b6b85e35dbe513b175f4c2311|6bc141b40c0f851d20fa9a1fe5fbdae94acc5de0)

2
Tests/RunCMake/file/GLOB-CONFIGURE_DEPENDS-RerunCMake-rebuild_second-stdout.txt
View File

@@ -1,2 +1,2 @@
.*Running CMake on GLOB-CONFIGURE_DEPENDS-RerunCMake
.*0c3ceab9daa7914fde7410c34cae4049e140aa51
.*(be528f629fe14e32494b2bba544361392e177d4c|0c3ceab9daa7914fde7410c34cae4049e140aa51)

4
Tests/RunCMake/file/RunCMakeTest.cmake
View File

@@ -144,6 +144,10 @@ else()
file(REMOVE_RECURSE "${RunCMake_TEST_BINARY_DIR}")
file(MAKE_DIRECTORY "${RunCMake_TEST_BINARY_DIR}/test")
if(NOT CMAKE_HOST_SYSTEM_NAME MATCHES "Windows|CYGWIN|MSYS")
# Test literal quotes in matched file names.
file(WRITE "${RunCMake_TEST_BINARY_DIR}/test/\".txt" "")
endif()
set(tf_1 "${RunCMake_TEST_BINARY_DIR}/test/1.txt")
file(WRITE "${tf_1}" "1")