From 96e9506ae9e252c548665152d1b8968297128307 Mon Sep 17 00:00:00 2001
From: Alexander Batischev <eual.jp@gmail.com>
Date: Sun, 13 Aug 2017 21:48:35 +0300
Subject: [PATCH] Sanitize inputs to bookmark-cmd (#591)

Newsbeuter didn't properly shell-escape the arguments passed to
bookmarking command, which allows a remote attacker to perform remote
code execution by crafting an RSS item whose title and/or URL contain
something interpretable by the shell (most notably subshell
invocations.)

This has been reported by Jeriko One <jeriko.one@gmx.us>, complete with
PoC and a patch.

This vulnerability was assigned CVE-2017-12904.

--- src/controller.cpp
+++ src/controller.cpp
@@ -1275,9 +1275,10 @@ std::string controller::bookmark(const std::string& url, const std::string& titl
 	std::string bookmark_cmd = cfg.get_configvalue("bookmark-cmd");
 	bool is_interactive = cfg.get_configvalue_as_bool("bookmark-interactive");
 	if (bookmark_cmd.length() > 0) {
-		std::string cmdline = utils::strprintf("%s '%s' %s %s",
+		std::string cmdline = utils::strprintf("%s '%s' '%s' '%s'",
 		                                       bookmark_cmd.c_str(), utils::replace_all(url,"'", "%27").c_str(),
-		                                       stfl::quote(title).c_str(), stfl::quote(description).c_str());
+		                                       utils::replace_all(title,"'", "%27").c_str(),
+		                                       utils::replace_all(description,"'", "%27").c_str());
 
 		LOG(LOG_DEBUG, "controller::bookmark: cmd = %s", cmdline.c_str());
 
