Be more strict about which PAGER to execvp() directly

There could be | or ; or other stuff in PAGER that needs
special handling, let's encode a list of known-good characters
instead. This covers all known pagers.

You could also try to execvp() PAGER in its entirety and if
it fails with ENOENT fall back to the shell but then you
don't get correct error handling if the pager really doesn't
exist (in which case we should abort trying to page).

1 files changed, 3 insertions, 1 deletions

diff --git a/apt-private/private-output.cc b/apt-private/private-output.cc
index e3f795cf3..4480d7382 100644
--- a/apt-private/private-output.cc
+++ b/apt-private/private-output.cc
@@ -165,7 +165,9 @@ bool InitOutputPager()
       {
 	 // If our pager name contains a space we need to invoke it in a shell. Boooo!
 	 char *cmd[] = {(char*)"/bin/sh", (char*)"-c", pager.data(), nullptr};
-	 if (std::none_of(pager.begin(), pager.end(), isspace_ascii))
+	 constexpr std::string_view allowed_chars{"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" "+-._=/"};
+	 static_assert(allowed_chars.size() == 26 + 26 + 10 + 6);
+	 if (pager.find_first_not_of(allowed_chars) == pager.npos)
 	 {
 	    cmd[0] = pager.data();
 	    cmd[1] = nullptr;