diff options
| author | Xi Lu <lx@shellcodes.org> | 2023-03-11 18:53:37 +0800 |
|---|---|---|
| committer | Ihor Radchenko <yantar92@posteo.net> | 2023-03-12 12:23:46 +0100 |
| commit | a8006ea580ed74f27f974d60b598143b04ad1741 (patch) | |
| tree | 2722a6deac0fd8afeafadf47b51a176449d5795a | |
| parent | dd25e2704f4a771e693c8d4a43ef6b7ced4f2062 (diff) | |
| download | org-mode-a8006ea580ed74f27f974d60b598143b04ad1741.tar.gz | |
* lisp/ob-latex.el: Fix command injection vulnerability
(org-babel-execute:latex):
Replaced the `(shell-command "mv BAR NEWBAR")' with `rename-file'.
TINYCHANGE
| -rw-r--r-- | lisp/ob-latex.el | 13 |
1 files changed, 5 insertions, 8 deletions
diff --git a/lisp/ob-latex.el b/lisp/ob-latex.el index a2c24b3..ce39628 100644 --- a/lisp/ob-latex.el +++ b/lisp/ob-latex.el @@ -218,17 +218,14 @@ This function is called by `org-babel-execute-src-block'." (if (string-suffix-p ".svg" out-file) (progn (shell-command "pwd") - (shell-command (format "mv %s %s" - (concat (file-name-sans-extension tex-file) "-1.svg") - out-file))) + (rename-file (concat (file-name-sans-extension tex-file) "-1.svg") + out-file t)) (error "SVG file produced but HTML file requested"))) ((file-exists-p (concat (file-name-sans-extension tex-file) ".html")) (if (string-suffix-p ".html" out-file) - (shell-command "mv %s %s" - (concat (file-name-sans-extension tex-file) - ".html") - out-file) - (error "HTML file produced but SVG file requested"))))) + (rename-file (concat (file-name-sans-extension tex-file) ".html") + out-file t) + (error "HTML file produced but SVG file requested"))))) ((or (string= "pdf" extension) imagemagick) (with-temp-file tex-file (require 'ox-latex) |
