Skip to content

Conversation

the-nick-of-time
Copy link

The call to latexrun inserts the job name, but doesn't do any shell escaping while passing it. Wrapping this input in single quotes keeps it from being split or otherwise processed by the next shell pass.

args=[
latexrun_file,
"--latex-args=-shell-escape -jobname=" + job_name,
"--latex-args=-shell-escape -jobname='" + job_name.replace("'", "'\\''") + "'",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we use something a bit more robust here, like shlex.quote() or pipes.quote() if we have to support Python 2 (I'm really not familiar with Python and don't know how to tell from a quick glance whether this is Python 2 or 3...)

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unless I'm missing something, we're using Python 3 (https://bazel.build/reference/be/python#py_binary.python_version). shlex.quote() would likely be the best way forward here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants