Escape shell commands properly.

diff --git a/uzbl.c b/uzbl.c
index 159a745..cdefa35 100644 (file)
--- a/uzbl.c
+++ b/uzbl.c
@@ -724,16 +724,19 @@ expand_template(const char *template) {
 static gboolean
 run_command (const char *command, const char *args, const gboolean sync, char **stdout) {
    //command <uzbl conf> <uzbl pid> <uzbl win id> <uzbl fifo file> <uzbl socket file> [args]
-    GString* to_execute = g_string_new ("");
+    GString *to_execute = g_string_new ("");
     GError *err = NULL;
-    gchar* cmd = g_strstrip(g_strdup(command));
+    gchar *cmd = g_strstrip(g_strdup(command));
+    gchar *qcfg = (uzbl.state.config_file ? g_shell_quote(uzbl.state.config_file) : g_strdup("''"));
+    gchar *qfifo = (uzbl.comm.fifo_path ? g_shell_quote(uzbl.comm.fifo_path) : g_strdup("''"));
+    gchar *qsock = (uzbl.comm.socket_path ? g_shell_quote(uzbl.comm.socket_path) : g_strdup("''"));
+    gchar *quri = (uzbl.state.uri ? g_shell_quote(uzbl.state.uri) : g_strdup("''"));
+    gchar *qtitle = (uzbl.gui.main_title ? g_shell_quote(uzbl.gui.main_title) : g_strdup("''"));
+    
     gboolean result;
-    g_string_printf (to_execute, "%s '%s' '%i' '%i' '%s' '%s'",
-                     cmd, (uzbl.state.config_file ? uzbl.state.config_file : "(null)"),
-                     (int) getpid(), (int) uzbl.xwin, uzbl.comm.fifo_path,
-                     uzbl.comm.socket_path);
-    g_string_append_printf (to_execute, " '%s' '%s'",
-                    uzbl.state.uri, uzbl.gui.main_title);
+    g_string_printf (to_execute, "%s %s '%i' '%i' %s %s",
+                     cmd, qcfg, (int) getpid(), (int) uzbl.xwin, qfifo, qsock);
+    g_string_append_printf (to_execute, " %s %s", quri, qtitle);
     if(args) g_string_append_printf (to_execute, " %s", args);
 
     if (sync) {
@@ -745,6 +748,12 @@ run_command (const char *command, const char *args, const gboolean sync, char **
         g_printerr("error on run_command: %s\n", err->message);
         g_error_free (err);
     }
+    
+    g_free (qcfg);
+    g_free (qfifo);
+    g_free (qsock);
+    g_free (quri);
+    g_free (qtitle);
     g_free (cmd);
     return result;
 }