gnulib-tool.py: Quote file names passed to 'patch'.

[Collin Funk <collin.funk1@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 474 bytes --]

I noticed that the file names when running 'patch' on test-driver
weren't quoted. I guess that would cause problems in practice if you
used spaces in directories, which I have my own opinions on. :)

Since we assume POSIX shells we can just use shlex.quote() to deal
with any theoretical shell injections too [1]. In practice I don't
think that should ever be a problem.

I've applied the attached patch.

[1] https://docs.python.org/3/library/shlex.html#shlex.quote

Collin

[-- Attachment #2: 0001-gnulib-tool.py-Quote-file-names-passed-to-patch.patch --]
[-- Type: text/x-patch, Size: 4076 bytes --]

From adc6d632afe4a7e055bf4cd0f4723fc922fa5d6c Mon Sep 17 00:00:00 2001
From: Collin Funk <collin.funk1@gmail.com>
Date: Wed, 1 May 2024 21:26:34 -0700
Subject: [PATCH] gnulib-tool.py: Quote file names passed to 'patch'.

* pygnulib/GLTestDir.py (_patch_test_driver): Import shlex and cleanup
unused imports. Use shlex.quote() on the file names passed to 'patch'.
* pygnulib/GLFileSystem.py (GLFileSystem.lookup): Likewise. Perform
redirection using sp.call() arguments instead of using the shell.
---
 ChangeLog                | 8 ++++++++
 pygnulib/GLFileSystem.py | 8 +++++---
 pygnulib/GLTestDir.py    | 9 ++++-----
 3 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 0e50c36566..bd2c45d9af 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2024-05-01  Collin Funk  <collin.funk1@gmail.com>
+
+	gnulib-tool.py: Quote file names passed to 'patch'.
+	* pygnulib/GLTestDir.py (_patch_test_driver): Import shlex and cleanup
+	unused imports. Use shlex.quote() on the file names passed to 'patch'.
+	* pygnulib/GLFileSystem.py (GLFileSystem.lookup): Likewise. Perform
+	redirection using sp.call() arguments instead of using the shell.
+
 2024-05-01  Bruno Haible  <bruno@clisp.org>
 
 	readutmp, boot-time: Improve for some Cygwin installations.
diff --git a/pygnulib/GLFileSystem.py b/pygnulib/GLFileSystem.py
index f8b7f54ab3..f2a98a0a28 100644
--- a/pygnulib/GLFileSystem.py
+++ b/pygnulib/GLFileSystem.py
@@ -20,7 +20,9 @@
 #===============================================================================
 import os
 import re
+import sys
 import filecmp
+import shlex
 import subprocess as sp
 from .constants import (
     DIRS,
@@ -32,7 +34,7 @@
     copyfile,
     substart,
 )
-from pygnulib.enums import CopyAction
+from .enums import CopyAction
 from .GLError import GLError
 from .GLConfig import GLConfig
 
@@ -104,9 +106,9 @@ def lookup(self, name: str) -> tuple[str, bool]:
                 copyfile(lookedupFile, tempFile)
                 ensure_writable(tempFile)
                 for diff_in_localdir in reversed(lookedupPatches):
-                    command = 'patch -s "%s" < "%s" >&2' % (tempFile, diff_in_localdir)
+                    command = f'patch -s {shlex.quote(tempFile)} < {shlex.quote(diff_in_localdir)}'
                     try:  # Try to apply patch
-                        sp.check_call(command, shell=True)
+                        sp.check_call(command, shell=True, stdout=sys.stderr)
                     except sp.CalledProcessError as exc:
                         raise GLError(2, name) from exc
                 result = (tempFile, True)
diff --git a/pygnulib/GLTestDir.py b/pygnulib/GLTestDir.py
index 3394468016..2d4c684248 100644
--- a/pygnulib/GLTestDir.py
+++ b/pygnulib/GLTestDir.py
@@ -21,6 +21,7 @@
 import os
 import re
 import sys
+import shlex
 import subprocess as sp
 from pathlib import Path
 from .constants import (
@@ -46,10 +47,8 @@
 from .enums import CopyAction
 from .GLError import GLError
 from .GLConfig import GLConfig
-from .GLModuleSystem import GLModuleTable
-from .GLModuleSystem import GLModuleSystem
+from .GLModuleSystem import GLModuleTable, GLModuleSystem
 from .GLFileSystem import GLFileSystem
-from .GLFileSystem import GLFileAssistant
 from .GLMakefileTable import GLMakefileTable
 from .GLEmiter import GLEmiter
 from .GLFileTable import GLFileTable
@@ -61,10 +60,10 @@ def _patch_test_driver() -> None:
     print('patching file %s' % test_driver)
     diffs = [ joinpath(DIRS['root'], name)
               for name in [joinpath('build-aux', 'test-driver.diff'),
-                           joinpath('build-aux', 'test-driver-1.16.3.diff')]]
+                           joinpath('build-aux', 'test-driver-1.16.3.diff')] ]
     patched = False
     for diff in diffs:
-        command = f'patch {test_driver} < {diff}'
+        command = f'patch {shlex.quote(test_driver)} < {shlex.quote(diff)}'
         try:
             result = sp.call(command, shell=True, stdout=sp.DEVNULL, stderr=sp.DEVNULL)
         except OSError as exc:
-- 
2.44.0