Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 730432 - sys-apps/gentoo-functions-0.13: einfo* & co. fail horribly if messages contain percent sign
Summary: sys-apps/gentoo-functions-0.13: einfo* & co. fail horribly if messages contai...
Status: IN_PROGRESS
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: William Hubbs
URL:
Whiteboard:
Keywords: InVCS, PATCH
Depends on:
Blocks:
 
Reported: 2020-07-02 06:39 UTC by Michał Górny
Modified: 2024-01-02 17:41 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
Refactor printf calls (0001-functions.sh-refactor-printf-calls.patch,3.72 KB, patch)
2020-07-04 16:15 UTC, Mike Gilbert
Details | Diff
Refactor printf calls v2 (0001-functions.sh-refactor-printf-calls.patch,3.73 KB, patch)
2020-07-04 16:23 UTC, Mike Gilbert
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2020-07-02 06:39:53 UTC
$ . /lib/gentoo/functions.sh 
$ einfo "test%test"
 * test0,000000e+00st
$ einfo "test%PYTHON_USEDEP%"
bash: printf: `P': invalid format character
 * test
Comment 1 Jeroen Roovers (RETIRED) gentoo-dev 2020-07-03 11:49:23 UTC
FTFY
Comment 2 Mike Gilbert gentoo-dev 2020-07-04 16:15:45 UTC
Created attachment 647584 [details, diff]
Refactor printf calls
Comment 3 Mike Gilbert gentoo-dev 2020-07-04 16:23:36 UTC
Created attachment 647586 [details, diff]
Refactor printf calls v2
Comment 4 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2020-07-04 16:35:10 UTC
You probably want %b, as it's  supposed to handle escapes.
Comment 5 Mike Gilbert gentoo-dev 2020-07-04 23:49:50 UTC
(In reply to Michał Górny from comment #4)
> You probably want %b, as it's  supposed to handle escapes.

Yeah, that makes sense. This might also be a good opportunity to make the behavior more closely match Portage's implementation.
Comment 6 Larry the Git Cow gentoo-dev 2023-02-15 07:46:28 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/proj/gentoo-functions.git/commit/?id=ce648e7539607a1809a1e4a037ade84bb4cde7b2

commit ce648e7539607a1809a1e4a037ade84bb4cde7b2
Author:     Kerin Millar <kfm@plushkava.net>
AuthorDate: 2023-02-15 07:35:20 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-02-15 07:43:55 +0000

    Do not use %b to decode user-supplied message strings
    
    For a long time, user-supplied message strings were injected into format
    strings used by printf. Obviously, doing so was a bad thing because it
    would cause printf to interpret any escape sequences and format
    specifiers that might be present in the string.
    
    The issue of specifier injection was dealt with by the introduction of
    _eprint(). This commit deals with the remaining issue by eliminating the
    use of %b, whose only effect was to needlessly try to decode the message
    string according to the same rules as echo -e (for XSI-conformant
    systems).
    
    Signed-off-by: Kerin Millar <kfm@plushkava.net>
    Bug: https://bugs.gentoo.org/730432
    Signed-off-by: Sam James <sam@gentoo.org>

 functions.sh | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

https://gitweb.gentoo.org/proj/gentoo-functions.git/commit/?id=34abe2307694673a704009d3baf8862008711fab

commit 34abe2307694673a704009d3baf8862008711fab
Author:     Kerin Millar <kfm@plushkava.net>
AuthorDate: 2023-02-15 05:03:42 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-02-15 07:32:35 +0000

    Implement - and integrate - an _eprint() helper function
    
    The _eprint() function encapsulates some of the behaviour that the
    following functions have in common.
    
      - ebegin
      - einfo
      - einfon
      - eerror
      - eerrorn
      - ewarnn
      - ewarn
    
    Additionally, have einfo() wrap einfon(), eerror() wrap eerrorn(), and
    ewarn() wrap ewarnn().
    
    All of this allows for a pleasing degree of code reduction while
    improving the structure of the functions overall, partly owing to a
    complementary reduction in the number of return statements. It also
    plots a course for the eventual implementation of proper TTY detection,
    in a context-sensitive manner.
    
    Bug: https://bugs.gentoo.org/730432
    Signed-off-by: Kerin Millar <kfm@plushkava.net>
    Signed-off-by: Sam James <sam@gentoo.org>

 functions.sh | 109 ++++++++++++++++++++---------------------------------------
 1 file changed, 37 insertions(+), 72 deletions(-)