From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from duke.felloff.net ([216.126.196.34]) by ewsd; Sat May 16 10:04:25 EDT 2020
Message-ID: <0C539553752FA1BAD2349A7EA7CF0902@felloff.net>
Date: Sat, 16 May 2020 16:04:15 +0200
From: cinap_lenrek@felloff.net
To: 9front@9front.org
Subject: Re: [9front] [PATCH] rio: add -label wctl param; improve window(1)
In-Reply-To: <5908F322508015DD8DD7AF2C02532108@a-b.xyz>
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
List-ID: <9front.9front.org>
List-Help: <http://lists.9front.org>
X-Glyph: ➈
X-Bullshit: compliant event hardware full-stack backend 

you want:

#pragma varargck argpos wsetlabel 2

and change:

+	if(label)
+		wsetlabel(w, label);

to:

+	if(label)
+		wsetlabel(w, "%s", label);

otherwise you got a classical format string attack.

about the -label flag in wctl message. i'm not so sure it is a good
idea. adding new flags there means a breaking change and updating rio
needs to be synchronized.

also we have the problem with quoting. (-cd also suffers from this).

i think running window recursively is not really the issue. the real
issue is that we have to properly preserve the arguments. all text
that comes after the last parsed word in wctl "new" word is passed
as a single argument to rc -c

however, when window receives multiple cmd arguments, we need to quote
the argument list proper as we'r essentially generating a rc script
that reproduces the argument list. the bug is when we do $"cmd
which destroys list tokenization.

a solution can be accomplished with rc's whatis, which lets rc
serialize a variable as a string that we can tunnel thru the wctl
text interface.

something like the diff at the bottom (this is just
for illustration, you can still simplify this further)?

note that we still handle one argument as a rc script for backwards
compatibility. so you can still do:

window 'echo hello; echo world; sleep 1'

but if you pass multile arguments, it will preserve the argument
list and not fail on strings that have spaces in them.

diff -r 4be989798860 rc/bin/window
--- a/rc/bin/window	Wed May 13 00:17:07 2020 +0200
+++ b/rc/bin/window	Sat May 16 15:52:47 2020 +0200
@@ -48,8 +48,11 @@
 		}
 }
 
-if(~ $#* 0) cmd=rc
-if not cmd=$*
+switch($#*){
+case 0; cmd=(rc -i)
+case 1; cmd=(rc -c $1)
+case *; cmd=$*
+}
 
 if(~ $#xflag 1){
 	echo -n `{basename $cmd(1)} >/dev/label >[2]/dev/null
@@ -100,5 +103,5 @@
 
 	if(! ~ $#wdir 0)
 		spec=($spec -cd $wdir)
-	echo new $spec $argv0 -x $cmd >>$wctl
+	echo new $spec `{whatis cmd} $argv0 -x '$cmd' >>$wctl
 }

--
cinap