Fix security problem in test-parse-duration.sh.

diff --git a/ChangeLog b/ChangeLog
index 09a9f2db5b8be66051bd280ea61811d6d4e5fc1a..aa368f8fc4c6114f4c3aa7ed0abe71d72f4564df 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2008-12-16  Bruno Haible  <bruno@clisp.org>
+
+       * tests/test-parse-duration.sh: Fix quoting of $tmp and $tmpf
+       expressions.
+
 2008-12-15  Bruno Haible  <bruno@clisp.org>
 
        * doc/glibc-functions/fgetxattr.texi: Tweak wording.

diff --git a/tests/test-parse-duration.sh b/tests/test-parse-duration.sh
index e6ebf90645441b5e266160a8bf8ded9a979856be..4c946ac2b1ecb5cd02b9791ca479c311f12ed6fe 100755 (executable)
--- a/tests/test-parse-duration.sh
+++ b/tests/test-parse-duration.sh
@@ -46,10 +46,10 @@ die ()
 }
 
 func_tmpdir
-trap "rm -rf ${tmp}" EXIT
-tmpf=${tmp}/tests.txt
+trap 'rm -rf "${tmp}"' EXIT
+tmpf="${tmp}/tests.txt"
 
-cat > ${tmpf} <<- _EOF_
+cat > "${tmpf}" <<- _EOF_
        1 Y 2 M 3 W 4 d 5 h 6 m 7 s
        P 00010225 T 05:06:07
        P 1Y2M3W4D T 5H6M7S
@@ -59,9 +59,9 @@ cat > ${tmpf} <<- _EOF_
        P 1-2-25 T 5:6:7
        _EOF_
 
-ls -l $tmpf
+ls -l "${tmpf}"
 
-exec 3< ${tmpf}
+exec 3< "${tmpf}"
 while read -u3 line
 do
     v=`${exe} "${line}"` || die "Failed: ${exe} '${line}'"