gentoo/dev-python/pygments/files/2.0.2-shell-injection-backport2.patch
Justin Lecher 0bd80b2412
dev-python/pygments: Backport fix for shell injection
Gentoo-Bug: https://bugs.gentoo.org/show_bug.cgi?id=564478

Package-Manager: portage-2.2.23
Signed-off-by: Justin Lecher <jlec@gentoo.org>
2015-10-30 13:03:49 +01:00

57 lines
1.8 KiB
Diff

# HG changeset patch
# User Tim Hatch <tim@timhatch.com>
# Date 1445007300 25200
# Node ID 0036ab1c99e256298094505e5e92fdacdfc5b0a8
# Parent c0c0d4049a7c325cd69b764c6ceb7747d319212d
Avoid the shell entirely when finding fonts.
Manually tested on OS X.
diff --git a/pygments/formatters/img.py b/pygments/formatters/img.py
--- a/pygments/formatters/img.py
+++ b/pygments/formatters/img.py
@@ -10,12 +10,13 @@
"""
import sys
-import shlex
from pygments.formatter import Formatter
from pygments.util import get_bool_opt, get_int_opt, get_list_opt, \
get_choice_opt, xrange
+import subprocess
+
# Import this carefully
try:
from PIL import Image, ImageDraw, ImageFont
@@ -76,14 +77,11 @@
self._create_nix()
def _get_nix_font_path(self, name, style):
- try:
- from commands import getstatusoutput
- except ImportError:
- from subprocess import getstatusoutput
- exit, out = getstatusoutput('fc-list %s file' %
- shlex.quote("%s:style=%s" % (name, style)))
- if not exit:
- lines = out.splitlines()
+ proc = subprocess.Popen(['fc-list', "%s:style=%s" % (name, style), 'file'],
+ stdout=subprocess.PIPE, stderr=None)
+ stdout, _ = proc.communicate()
+ if proc.returncode == 0:
+ lines = stdout.splitlines()
if lines:
path = lines[0].strip().strip(':')
return path
@@ -198,7 +196,7 @@
bold and italic fonts will be generated. This really should be a
monospace font to look sane.
- Default: "Bitstream Vera Sans Mono"
+ Default: "Bitstream Vera Sans Mono" on Windows, Courier New on *nix
`font_size`
The font size in points to be used.