https://gitlab.synchro.net/main/sbbs/-/commit/71736412815af6bc2f071367
Modified Files:
docs/v322_new.md src/sbbs3/filedat.c sbbsdefs.h src/sbbs3/scfg/scfgxfr1.c src/sbbs3/xtrn.cpp
Log Message:
Don't let a filename defeat the quoting of an external command line

cmdstr() double-quotes the values it substitutes for %a, %o, %f and %~,
but only when the value contained a space, and sh expands $ and a
back-tick even inside double quotes. So a file-base filename could
still reach a command shell carrying characters the shell interprets: ILLEGAL_FILENAME_CHARS already excludes " and \, but not $, `, &, (,
), ' or the glob characters. File viewers are the exposed path --
their ex_mode defaults to EX_STDIO|EX_SH in scfglib2.c, so a
sysop-configured viewer command containing %f runs through sh -c or
cmd /c.

Widen quoted_string()'s trigger to SHELL_QUOTE_CHARS, the characters a
shell interprets outside double quotes but not inside them, and keep SHELL_EXPANSION_CHARS ($ and a back-tick) out of uploaded filenames in allowed_filename(), since no amount of quoting protects those.

The restriction is deliberately in allowed_filename() rather than ILLEGAL_FILENAME_CHARS: illegal_filename() hacklogs its hits and is
applied to names already stored in the file base and to names arriving
over FTP, in message attachments and in QWK packets, so widening it
would turn existing legal filenames into logged attack attempts.
$ and a back-tick are legal on Windows and are not cmd.exe
metacharacters, but file bases are shared between platforms, so a name
uploaded here eventually reaches a POSIX host.

Also teach the *nix argv splitter about those quotes. It splits on
spaces only and never stripped a quote, so ever since cmdstr() began auto-quoting in 58bfc11aa7 (2005-09-02) a %f filename containing a space
has reached a non-shell program as two arguments with literal "
characters embedded. The splitter itself dates to e3a47718311
(2003-02-28) and predates the quoting by two years. Windows is
unaffected: its external() hands the whole command line to
CreateProcess() and the child's CRT parses the quotes.

The SCFG help text spells the two characters out rather than
interpolating SHELL_EXPANSION_CHARS, because a back-tick in a uifc
helpbuf toggles highlighting instead of being displayed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net