From be3c71fa81e6d35a1fae0612a8b7b4b613d7d2f6 Mon Sep 17 00:00:00 2001 From: Dave Reisner Date: Tue, 30 Jul 2013 15:24:48 -0400 Subject: avoid injecting code into the format string Now that die() properly forwards arguments to error(), we can expect that the first arg is a format string and not the entirety of the output. Signed-off-by: Dave Reisner Signed-off-by: Pierre Schmitz --- mkarchroot.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'mkarchroot.in') diff --git a/mkarchroot.in b/mkarchroot.in index 970bbb9..7cdb274 100644 --- a/mkarchroot.in +++ b/mkarchroot.in @@ -51,7 +51,7 @@ fi umask 0022 -[[ -e $working_dir ]] && die "Working directory '$working_dir' already exists" +[[ -e $working_dir ]] && die "Working directory '%s' already exists" "$working_dir" mkdir -p "$working_dir" @@ -60,7 +60,7 @@ lock 9 "${working_dir}.lock" "Locking chroot" if [[ $(stat -f -c %T "$working_dir") == btrfs ]]; then rmdir "$working_dir" if ! btrfs subvolume create "$working_dir"; then - die "Couldn't create subvolume for '$working_dir'" + die "Couldn't create subvolume for '%s'" "$working_dir" fi chmod 0755 "$working_dir" fi -- cgit v1.2.3