Debian Bug report logs - #960734
sensible-utils: does not execute shell in EDITOR and VISUAL

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "brian m. carlson" <sandals@crustytoothpaste.net>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: sensible-utils: does not execute shell in EDITOR and VISUAL

Date: Fri, 15 May 2020 23:17:44 +0000

[Message part 1 (text/plain, inline)]

Package: sensible-utils
Version: 0.0.12+nmu1
Severity: normal
Tags: patch

It is generally possible in EDITOR and VISUAL to place arbitrary shell.
For example, one can write something like the following:

  export VISUAL='f(){ if [ -n "$DISPLAY" ]; then gvim -f "$@"; else vim "$@"; fi; };f'

This is supported by every program I can find which uses EDITOR and
VISUAL, including less, crontab, mutt, and git.  It is my understanding
that supporting this is intentional, because otherwise it is impossible
to place quoted arguments inside a shell value, like so:

  export VISUAL='vim +"setf perl"'

However, sensible-editor does not support that.  It does perform shell
word splitting, but shell word splitting is not sufficient to handle the
cases mentioned above.

I've submitted a merge request at
https://salsa.debian.org/debian/sensible-utils/-/merge_requests/4 to
implement this behavior, add a test, and improve the existing test to be
more robust.

-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 5.6.0-1-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

-- no debconf information

-- 
brian m. carlson: Houston, Texas, US
OpenPGP: https://keybase.io/bk2204

[signature.asc (application/pgp-signature, inline)]

Message #14 received at 960734-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 960734-close@bugs.debian.org

Subject: Bug#960734: fixed in sensible-utils 0.0.18

Date: Sat, 18 Mar 2023 23:04:13 +0000

Source: sensible-utils
Source-Version: 0.0.18
Done: Bastien Roucariès <rouca@debian.org>

We believe that the bug you reported is fixed in the latest version of
sensible-utils, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 960734@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bastien Roucariès <rouca@debian.org> (supplier of updated sensible-utils package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 18 Mar 2023 22:33:38 +0000
Source: sensible-utils
Architecture: source
Version: 0.0.18
Distribution: experimental
Urgency: medium
Maintainer: Anibal Monsalve Salazar <anibal@debian.org>
Changed-By: Bastien Roucariès <rouca@debian.org>
Closes: 594942 960734 993393 1005034
Changes:
 sensible-utils (0.0.18) experimental; urgency=medium
 .
   [ Debian Janitor ]
   * Remove constraints unnecessary since buster:
     + sensible-utils: Drop versioned constraint on debianutils and manpages-pl
       in Replaces.
 .
   [ Bastien Roucariès ]
   * Aknowledge NMU
   * Bug fix: "[INTL:de] updated German man page translation", thanks to
     Helge Kreutzmann (Closes: #993393).
   * Rules-Requires-Root: no
   * Bump standards version (no changes)
   * EDITOR, VISUAL, PAGER, BROWSER follow environ(7).
     Any string acceptable as a command_string operand
     to the sh -c command shall be valid.
     (Closes: #960734).
   * Bug fix: "Please provide a sensible-term (like x-terminal-emulator
     alternative but user-configurable)", thanks to Josh Triplett (Closes:
     #594942).
   * Bug fix: "sensible-editor treats spaces differently in VISUAL and
     EDITOR", thanks to Julian Gilbey (Closes: #1005034).
Checksums-Sha1:
 6dc1cbd412e3e3130d8480f08b8f02ef419dba08 1737 sensible-utils_0.0.18.dsc
 0dda9f62c9761d48203f6e46d843a5043bf4cc5c 70892 sensible-utils_0.0.18.tar.xz
 b36c14da14eda1d71843c0b2229594f60529277f 6374 sensible-utils_0.0.18_source.buildinfo
Checksums-Sha256:
 4873d370c5fdbe9370bce32f26d5a665eb3fbdd0ed2b11b41f09c5df26df0ac2 1737 sensible-utils_0.0.18.dsc
 ccb0a442ed720e815e914089962a01a45bb2ea7ba01dbaa03676ebef53430dc5 70892 sensible-utils_0.0.18.tar.xz
 c9e0022b000885577667106de7af197a455d7e718d570a8cf4a49fc8ae5a74c5 6374 sensible-utils_0.0.18_source.buildinfo
Files:
 ec84ebf50f17d0c0bb577354eb1634b4 1737 utils required sensible-utils_0.0.18.dsc
 50ab8bc5ca7cff14c315cc1a7d5d9c87 70892 utils required sensible-utils_0.0.18.tar.xz
 c774ef75a597dd4ac5a09ba0572573a0 6374 utils required sensible-utils_0.0.18_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmQWP78RHHJvdWNhQGRl
Ymlhbi5vcmcACgkQADoaLapBCF89KhAAiXgayRf7LP2ZFBZ3JOmLB4jcO9WKqC+R
unHVvDwi39ZWA9mcK9UvX8i9OGDxKwPLGWwtYWhYjX0+h69Dl9l19rYohC9tcctT
wL42j10PF3WgfGU6L2A8KwkQcdPhovv2qwhbywCzQ+/14QLR6LukRbjWx9QxXjSw
LxWW/PMjUxNP3MsRCHu4noUdTAzCTSfPIxgQjJbAbsiA8PLTOd10vBdA2GhvtCg7
5dZ19InjAnq1GymgRrBBWTIJnnJY03ADqR3gKY8WksCpcYESgxh+4Zr8sFbQiqa5
1UFL2PMa+pimvGZUcF9rX1qWVECZEE5uGjkRH7AxZUWSqx0r2ZEp0Zmt7gOLc7FD
APWziIcXnc/rrXGyABG7mgx7h9c+THyJASKXjOgSBswRkq2Wv/1ybH6bVMjBoS7x
O4gyKsfSsh4CajEnlgyVXKYXT+wDWrhrfTCkmb6RD6TN7LSTkpvhZ2q7x5QHdE50
6VGlIf4JEUfUQJTOgDJbcDXQP1t+ZvOEbBf1vuM2YmHkUayccPPefAwHpr8T5HsU
iZNd2zwyhKdVzsn8yxLwAJMGUG+d79m9uKwjb2VuNzD4r5mXBz592e7tjSCENnFp
yC2v0/WYrJV6obrx+zKSMSI3Qpl3uNF1sp2VQs5g5bZahD8jsRr8xxlO0h9DcAFe
E7rXP3r40VQ=
=KHSZ
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.