From 30bd52e0cd3381bc2b6795b50fcbd78501ccfcce Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Sun, 2 Aug 2026 21:28:47 +1000 Subject: [PATCH] daemon: reject shell-active hook expansions (cherry picked from commit 00160f76b8fea3f1969f71716f448fae6bf64639) --- loadparm.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/loadparm.c b/loadparm.c index 135e6593..57f909a1 100644 --- a/loadparm.c +++ b/loadparm.c @@ -175,14 +175,13 @@ enum shell_quote_context { * context-aware escaping is correct for exactly one level of shell parsing, * and a hook such as `sh -c '... %RSYNC_USER_NAME% ...'` re-parses the word in * a second shell that sees the value bare. Peer-supplied values carrying any - * of these are refused instead. Word-splitting and glob characters are left - * alone: they cannot execute anything, and paths legitimately contain them. */ + * of these are refused instead. */ static int shell_unsafe_value(const char *val) { const char *s; for (s = val; *s; s++) { - if (strchr("'\"`$\\;&|<>()", *s) + if (strchr("'\"`$\\;&|<>()*?[]# ", *s) || (unsigned char)*s < 0x20 || (unsigned char)*s == 0x7f) return 1; }