Item9140: Sandbox::sysCommand template parsing

Foswiki::Sandbox::sysCommand incorrectly parses the template. Namely, in the following code:

    # Implicit untaint OK; $template is safe
    $template =~ /(^.*?)\s+(.*)$/;
    my $path  = $1;
    my $pTmpl = $2;

the regexp fails if the $template contains no spaces (e.g. a program call without arguments), so that $path and $pTmpl are filled with arbitrary junk from a previous regexp matched somewhere else.

By the way, why ^ is inside the parentheses?

-- MikhailRyazanov - 11 Jun 2010

No particular reason. Doesn't actually matter.

Thanks for spotting this one - fixed in trunk.

-- CrawfordCurrie - 11 Jun 2010

Commenting is disabled while not logged in