muquit / mrdialog Goto Github PK

As the user of the library is unaware of how the dialog commands are executed, it is not easy to sanitize the input so that exploits are not possible. For example, using Shellwords doesn't work.
I ran into issues where the user can input something that results in a string that contains for example ..."; /bin/sh .... When passed to #yesno the user is dropped into the shell with some dialog error message.

Example:

$ ruby -rmrdialog -e 'MRDialog.new.yesno("foo: \"; /bin/sh\n", 0, 0); puts "bar"'
Error: Expected at least 3 tokens for --yesno, have 1.
Use --help to list options.

$

I had to look into the code to see that I should escape the double quotes in the arguments, but mrdialog could have just as well single quotes or, much safer, and argument array for system.
It would be best if mrdialog did the sanitization instead of the developer so that it corresponds with the way it calls the command, or if mrdialog just plain switches to array arguments.

Hello,

I am facing the same issue as here:
https://unix.stackexchange.com/questions/35670/how-to-insert-tab-character-in-dialog

The text can't contain additional spaces or tabs, those being stripped.

The solution is to add an additional argument to the dialog called --no-collapse.

The following code should do it.

in lib/mrdialog/mrdialog.rb add a new attribute

#
# Allows insertion of multiple spaces or tabs
# 
attr_accessor :no_collapse

in lib/mrdialog/mrdialog.rb inside option_string method

if @no_collapse
  ostring += "--no-collapse "
end

Hi, I have found errors installing gem (ruby 2.2.4):

# gem install mrdialog
Fetching: mrdialog-1.0.3.gem (100%)
Successfully installed mrdialog-1.0.3
Parsing documentation for mrdialog-1.0.3
Installing ri documentation for mrdialog-1.0.3
ERROR:  While executing gem ... (NoMethodError)
    undefined method `intern' for []:Array

Same error in ruby 2.1.8.

Same error with mrdialog-1.0.2

With mrdialog-1.0.1 seems to works fine:

# gem install --local ./mrdialog-1.0.1.gem 
Successfully installed mrdialog-1.0.1
Parsing documentation for mrdialog-1.0.1
Installing ri documentation for mrdialog-1.0.1
Done installing documentation for mrdialog after 0 seconds
1 gem installed