fix shell quoting

This adds missing cases to shell_quote(...), preventing potential priviledge
escalation.

Author: kroening

src/util/run.cpp

@@ -27,16 +27,17 @@ Date: August 2012
 // clang-format on
 #else
 
-#include <cstring>
-#include <cerrno>
-#include <cstdio>
-#include <cstdlib>
-
-#include <fcntl.h>
-#include <signal.h>
-#include <sys/stat.h>
-#include <sys/wait.h>
-#include <unistd.h>
+#  include <sys/stat.h>
+#  include <sys/wait.h>
+
+#  include <cctype>
+#  include <cerrno>
+#  include <cstdio>
+#  include <cstdlib>
+#  include <cstring>
+#  include <fcntl.h>
+#  include <signal.h>
+#  include <unistd.h>
 
 #endif
 
@@ -486,18 +487,18 @@ std::string shell_quote(const std::string &src)
 
   // first check if quoting is needed at all
 
-  if(src.find(' ')==std::string::npos &&
-     src.find('"')==std::string::npos &&
-     src.find('*')==std::string::npos &&
-     src.find('$')==std::string::npos &&
-     src.find('\\')==std::string::npos &&
-     src.find('?')==std::string::npos &&
-     src.find('&')==std::string::npos &&
-     src.find('|')==std::string::npos &&
-     src.find('>')==std::string::npos &&
-     src.find('<')==std::string::npos &&
-     src.find('^')==std::string::npos &&
-     src.find('\'')==std::string::npos)
+  bool quotes_needed = false;
+
+  if(src.empty())
+    quotes_needed = true;
+  else
+  {
+    for(auto &ch : src)
+      if(!isalnum(ch) && ch != '_' && ch != '.')
+        quotes_needed = true;
+  }
+
+  if(!quotes_needed)
   {
     // seems fine -- return as is
     return src;

unit/util/run.cpp

@@ -13,6 +13,21 @@ Author: Michael Tautschnig
 
 #include <fstream>
 
+SCENARIO("shell_quote() escaping", "[core][util][run]")
+{
+#ifdef _WIN32
+  REQUIRE(shell_quote("foo.bar") == "foo.bar");
+  REQUIRE(shell_quote("foo&bar") == "\"foo\nbar\"");
+  REQUIRE(shell_quote("foo(bar)") == "\"foo(bar)\"");
+  REQUIRE(shell_quote("foo\"bar") == "\"foo\"\"bar\"");
+#else
+  REQUIRE(shell_quote("foo.bar") == "foo.bar");
+  REQUIRE(shell_quote("foo\nbar") == "'foo\nbar'");
+  REQUIRE(shell_quote("foo(bar)") == "'foo(bar)'");
+  REQUIRE(shell_quote("foo'bar") == "'foo\'bar'");
+#endif
+}
+
 SCENARIO("run() error reporting", "[core][util][run]")
 {
   GIVEN("A command invoking a non-existent executable")