diff options
| -rw-r--r-- | src/alert.cpp | 10 | ||||
| -rw-r--r-- | src/util.cpp | 13 | ||||
| -rw-r--r-- | src/util.h | 1 |
3 files changed, 15 insertions, 9 deletions
diff --git a/src/alert.cpp b/src/alert.cpp index b900fe41e5..7f7e59ee10 100644 --- a/src/alert.cpp +++ b/src/alert.cpp @@ -241,15 +241,7 @@ bool CAlert::ProcessAlert(bool fThread) // be safe we first strip anything not in safeChars, then add single quotes around // the whole string before passing it to the shell: std::string singleQuote("'"); - // safeChars chosen to allow simple messages/URLs/email addresses, but avoid anything - // even possibly remotely dangerous like & or > - std::string safeChars("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890 .,;_/:?@"); - std::string safeStatus; - for (std::string::size_type i = 0; i < strStatusBar.size(); i++) - { - if (safeChars.find(strStatusBar[i]) != std::string::npos) - safeStatus.push_back(strStatusBar[i]); - } + std::string safeStatus = SanitizeString(strStatusBar); safeStatus = singleQuote+safeStatus+singleQuote; boost::replace_all(strCmd, "%s", safeStatus); diff --git a/src/util.cpp b/src/util.cpp index 9562cf310a..5411bb2fe3 100644 --- a/src/util.cpp +++ b/src/util.cpp @@ -475,6 +475,19 @@ bool ParseMoney(const char* pszIn, int64_t& nRet) return true; } +// safeChars chosen to allow simple messages/URLs/email addresses, but avoid anything +// even possibly remotely dangerous like & or > +static string safeChars("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890 .,;_/:?@"); +string SanitizeString(const string& str) +{ + string strResult; + for (std::string::size_type i = 0; i < str.size(); i++) + { + if (safeChars.find(str[i]) != std::string::npos) + strResult.push_back(str[i]); + } + return strResult; +} const signed char p_util_hexdigit[256] = { -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1, diff --git a/src/util.h b/src/util.h index e52e6986b5..7fae5cc7ec 100644 --- a/src/util.h +++ b/src/util.h @@ -175,6 +175,7 @@ void ParseString(const std::string& str, char c, std::vector<std::string>& v); std::string FormatMoney(int64_t n, bool fPlus=false); bool ParseMoney(const std::string& str, int64_t& nRet); bool ParseMoney(const char* pszIn, int64_t& nRet); +std::string SanitizeString(const std::string& str); std::vector<unsigned char> ParseHex(const char* psz); std::vector<unsigned char> ParseHex(const std::string& str); bool IsHex(const std::string& str); |