>From 9ff941c6de689e28c4cbc8306262024bca2b2068 Mon Sep 17 00:00:00 2001
From: Peter Bex <address@hidden>
Date: Sun, 17 Feb 2013 15:49:03 +0100
Subject: [PATCH] Change "qs" so it uses a more robust quoting style, not based
 on a blacklist. Fix setup-api's "find-program" to not quote the program name
 twice.

Contributed by Florian Zumbiehl

Signed-off-by: Peter Bex <address@hidden>
---
 NEWS          |  3 +++
 setup-api.scm |  2 +-
 utils.scm     | 26 ++++++++++++--------------
 3 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/NEWS b/NEWS
index 018d57a..0938034 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,9 @@
   - CVE-2013-1874: ./.csirc is no longer loaded from the current directory
     upon startup of csi, which could lead to untrusted code execution.
     (thanks to Florian Zumbiehl)
+  - On *nix, the qs procedure now single-quotes everything instead of relying
+    on a blacklist of shell characters to be escaped.  On Windows, it properly
+    duplicates double-quote characters.  (thanks to Florian Zumbiehl)
 
 - Tools
   - csc: added "-oi"/"-ot" options as alternatives to "-emit-inline-file"
diff --git a/setup-api.scm b/setup-api.scm
index 9309ca8..7370b56 100644
--- a/setup-api.scm
+++ b/setup-api.scm
@@ -237,7 +237,7 @@
   (cond ((string=? prg "csc")
 	 (string-intersperse 
 	  (cons*
-	   (shellpath (find-program "csc"))
+	   (find-program "csc")
 	   "-feature" "compiling-extension" 
 	   (if (or (deployment-mode)
 		   (and (feature? #:cross-chicken)
diff --git a/utils.scm b/utils.scm
index 94417fc..c5edda4 100644
--- a/utils.scm
+++ b/utils.scm
@@ -59,20 +59,18 @@
 ;;; Quote string for shell
 
 (define (qs str #!optional (platform (build-platform)))
-  (case platform
-    ((mingw32)
-     (string-append "\"" str "\""))
-    (else
-     (if (zero? (string-length str))
-	 "''"
-	 (string-concatenate
-	  (map (lambda (c)
-		 (if (or (char-whitespace? c)
-			 (memq c '(#\# #\" #\' #\` #\� #\~ #\& #\% #\$ #\! #\* #\;
-				   #\< #\> #\\ #\( #\) #\[ #\] #\{ #\} #\? #\|)))
-		     (string #\\ c)
-		     (string c)))
-	       (string->list str)))))))
+  (let ((delim (if (eq? platform 'ming32) "\"" "'"))
+        (escaped (if (eq? platform 'ming32) "\"\"" "'\\''")))
+    (string-append
+     delim
+     (string-concatenate
+      (map (lambda (c)
+             (cond
+              ((char=? c delim) escaped)
+              ((char=? c #\nul) (error 'qs "NUL character can not be represented in shell string" str))
+              (else (string c))))
+           (string->list str)))
+     delim)))
 
 
 ;;; Compile and load file
-- 
1.8.0.1