bug#66390: `man' allows to inject arbitrary shell code

[Max Nikulin]

On 08/10/2023 12:28, Eli Zaretskii wrote:
> > Date: Sun, 8 Oct 2023 10:37:33 +0700 From: Max Nikulin
>
> > I had in mind using at least `shell-quote-argument'.
> That doesn't work with 'man', which has its own ideas about quoting,
> besides shell-related quoting.

I see usage of `shell-quote-argument' for completion where shell is not 
involved. During formatting there is parsing of references with some 
regular expressions to get (X) section suffix, but I have not noticed 
quoting. Certainly the code relies on spaces passed literally and 
substituted into shell command directly. If there were page names with 
spaces it would be a problem.

I mean passing through `shell-quote-argument' each word returned by 
`Man-translate-references'

P.S.

(defun Man-translate-cleanup (string)
  "Strip leading, trailing and middle spaces."
   ^^^^^^^^^^^^^

(Man-translate-cleanup " w")
" w"

?