Uploaded image for project: 'Nuxeo Platform'
  1. Nuxeo Platform
  2. NXP-17285

Make CommandlineService accept and quote any parameter

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 7.10
    • Component/s: Core

      Description

      The CommandLineExecutorComponent checks if the parameters are valid by applying a hard coded pattern:

      public interface CommandLineExecutorService {
          Pattern VALID_PARAMETER_PATTERN = Pattern.compile("[\\p{L}_0-9-.%:=/\\\\ ]+");
          Pattern VALID_PARAMETER_PATTERN_WIN = Pattern.compile("[\\p{L}_0-9-.%~:=/\\\\ ()]+");
      . . .
      

      This pattern is used when the AbstractExecutor replaces the parameters (for example, in public static String getParametersString())

      The problem is, this pattern is too restrictive. When using ImageMagick for example, the following command line is ok. It contains a color definition as "#rrggbb":

      compare img1.png img2.png -highlight-color "#ff0055" result.png
      

      An error if triggered when using it:

      exception_message : '#ff0055' contains illegal characters. It should match: [\p{L}_0-9-.%:=/\\ ]+
      

      (same error when using "rgb(255, 0, 100)", because of the parenthesis)

      So the ticket is about being able to change the patter. At least to accept # and ( and ):

      • Just change the hard coded pattern if allowing # and ( and ) is safe
      • Or have a way to disable the pattern matching (so the client is responsible for having check everything before calling the service)
      • Or allow passing a non null, non empty pattern just when calling execCommand
      • Or (room for other ideas)

        Attachments

          Issue Links

            Activity

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: