From ab9a606473cf507d0f422b3f30ca98b7ba375b0e Mon Sep 17 00:00:00 2001 From: Vasilij Schneidermann Date: Wed, 27 Jan 2021 21:53:28 +0100 Subject: [PATCH] Use shlex to shell quote user input properly --- stable/say.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/stable/say.py b/stable/say.py index 39d46a6..f4c21eb 100644 --- a/stable/say.py +++ b/stable/say.py @@ -9,15 +9,16 @@ On OSX will use the built in 'say' command. import prof import os +import shlex from sys import platform def say(message): args = prof.settings_string_get("say", "args", "") if platform == "darwin": - os.system("say " + args + " '" + message + "' 2>/dev/null") + os.system("say " + args + " " + shlex.quote(message) + " 2>/dev/null") elif platform == "linux" or platform == "linux2": - os.system("echo '" + message + "' | espeak " + args + " 2>/dev/null") + os.system("echo " + shlex.quote(message) + " | espeak " + args + " 2>/dev/null") def prof_post_chat_message_display(barejid, resource, message):