Foot Version
1.27.0
TERM environment variable
foot
Compositor Name and Version
sway 1.11
Distribution
arch
Terminal multiplexer
No response
Shell, TUI, application
No response
Server/standalone mode
- Standalone
- Server
Foot config
default
Description of Bug and Steps to Reproduce
selection.c decode_one_uri (line ~2073):
if (streq(scheme, "file") && hostname_is_localhost(host)) {
if (ctx->quote_paths)
ctx->cb("'", 1, ctx->user);
ctx->cb(path, strlen(path), ctx->user);
if (ctx->quote_paths)
ctx->cb("'", 1, ctx->user);
} else
ctx->cb(uri, len, ctx->user);
quote_paths is true when term->grid == &term->normal, so the path
is wrapped in single quotes when dropped on the normal grid (typical
shell prompt). The path itself is whatever uri_parse() returns after
%xx-decoding the input URI; single quotes inside the path are not
escaped, doubled, or rejected, so they terminate the surrounding
single-quoted region.
Reproduce:
# Create a file whose name contains a single quote and a shell
# metacharacter sequence.
touch "/tmp/foo';id #.txt"
# Drag this file from a file manager onto a foot window running
# a shell.
The file manager hands foot the URI
file:///tmp/foo%27%3Bid%20%23.txt. uri_parse decodes the path to
/tmp/foo';id #.txt. decode_one_uri concatenates ', the path, and
', producing this byte stream to the slave:
'/tmp/foo';id #.txt'
A POSIX shell parses that as: argument /tmp/foo, command separator
;, command id, comment #.txt'. Pressing Enter (or, on shells
without bracketed paste, immediately) runs id.
Bracketed paste reduces this to "user must press Enter once", but
does not prevent execution if the user accepts the paste.
Fix: in decode_one_uri, escape single quotes inside path before
emitting (POSIX form: replace each ' with '\''), or refuse paths
containing characters that would break shell quoting. Same treatment
is needed for the non-localhost branch that emits the raw URI: a
file: URI containing a single quote is rejected upstream by
uri_parse, but non-file: URIs with single quotes in the path or
authority would also break.
(END)
Relevant logs, stacktraces, etc.
No response