disallow certain characters

Author: danmar

lib/cppcheck.cpp

@@ -306,8 +306,22 @@ namespace {
 
 std::string CppCheck::cmdFileName(std::string f)
 {
+    // do not allow characters that potentially has a special meaning for the shell
+    const auto badpos = f.find_first_of("\t\n\r;$<>|&`");
+    if (badpos != std::string::npos) {
+        std::string c;
+        if (f[badpos] == '\n')
+            c = "<new-line>";
+        else if (f[badpos] == '\r')
+            c = "<carriage-return>";
+        else if (f[badpos] == '\t')
+            c = "<tab>";
+        else
+            c += f[badpos];
+        throw std::runtime_error("Cppcheck does not allow character " + c + " in filename " + f);
+    }
     f = Path::toNativeSeparators(std::move(f));
-    if (f.find_first_of(" \t;$<>|&`\n") != std::string::npos)
+    if (f.find(' ') != std::string::npos)
         return "\"" + f + "\"";
     return f;
 }

test/testcppcheck.cpp

@@ -626,13 +626,15 @@ class TestCppcheck : public TestFixture {
     void cmdFileName() const {
         ASSERT_EQUALS("x", CppCheck::cmdFileName("x"));
         ASSERT_EQUALS("\" \"", CppCheck::cmdFileName(" "));
-        ASSERT_EQUALS("\"\t\"", CppCheck::cmdFileName("\t"));
-        ASSERT_EQUALS("\";\"", CppCheck::cmdFileName(";"));
-        ASSERT_EQUALS("\">\"", CppCheck::cmdFileName(">"));
-        ASSERT_EQUALS("\"<\"", CppCheck::cmdFileName("<"));
-        ASSERT_EQUALS("\"|\"", CppCheck::cmdFileName("|"));
-        ASSERT_EQUALS("\"`\"", CppCheck::cmdFileName("`"));
-        ASSERT_EQUALS("\"$\"", CppCheck::cmdFileName("$"));
+        ASSERT_THROW_EQUALS(CppCheck::cmdFileName("\t"), std::runtime_error, "Cppcheck does not allow character <tab> in filename \t");
+        ASSERT_THROW_EQUALS(CppCheck::cmdFileName("\r"), std::runtime_error, "Cppcheck does not allow character <carriage-return> in filename \r");
+        ASSERT_THROW_EQUALS(CppCheck::cmdFileName("\n"), std::runtime_error, "Cppcheck does not allow character <new-line> in filename \n");
+        ASSERT_THROW_EQUALS(CppCheck::cmdFileName(";"), std::runtime_error, "Cppcheck does not allow character ; in filename ;");
+        ASSERT_THROW_EQUALS(CppCheck::cmdFileName(">"), std::runtime_error, "Cppcheck does not allow character > in filename >");
+        ASSERT_THROW_EQUALS(CppCheck::cmdFileName("<"), std::runtime_error, "Cppcheck does not allow character < in filename <");
+        ASSERT_THROW_EQUALS(CppCheck::cmdFileName("|"), std::runtime_error, "Cppcheck does not allow character | in filename |");
+        ASSERT_THROW_EQUALS(CppCheck::cmdFileName("`"), std::runtime_error, "Cppcheck does not allow character ` in filename `");
+        ASSERT_THROW_EQUALS(CppCheck::cmdFileName("$"), std::runtime_error, "Cppcheck does not allow character $ in filename $");
     }
 
     // TODO: test suppressions