7575import shlex # Added for POSIX shell escaping
7676
7777# input validation helper
78- def safe_name (value , context ):
79- """
80- Validates that the input string does not contain characters dangerous
81- for filesystem paths or shell command injection.
82- """
83- if not value :
84- raise ValueError (f"{ context } cannot be empty" )
85- # blocks path traversal (/, \), control characters, and shell metacharacters (*, ?, <, >, |, ;, &, $, `, ', ", (, ))
86- if re .search (r'[\x00-\x1F\x7F\\/:*?"<>|;&`$\'()]' , value ):
87- raise ValueError (f"Unsafe { context } : '{ value } ' contains illegal characters." )
88- return value
78+ def safe_name (value , context , allow_path = False ):
79+ """
80+ Validates that the input string does not contain characters dangerous
81+ for filesystem paths or shell command injection.
82+ """
83+ if not value :
84+ raise ValueError (f"{ context } cannot be empty" )
85+ # blocks control characters and shell metacharacters
86+ # allow path separators and drive colons for full paths when needed
87+ if allow_path :
88+ pattern = r'[\x00-\x1F\x7F*?"<>|;&`$\'()]'
89+ else :
90+ # blocks path traversal (/, \, :) in addition to shell metacharacters
91+ pattern = r'[\x00-\x1F\x7F\\/:*?"<>|;&`$\'()]'
92+ if re .search (pattern , value ):
93+ raise ValueError (f"Unsafe { context } : '{ value } ' contains illegal characters." )
94+ return value
8995
9096MKCONCORE_VER = "22-09-18"
9197
@@ -146,8 +152,8 @@ def _resolve_concore_path():
146152sourcedir = sys .argv [2 ]
147153outdir = sys .argv [3 ]
148154
149- # Validate outdir argument
150- safe_name (outdir , "Output directory argument" )
155+ # Validate outdir argument (allow full paths)
156+ safe_name (outdir , "Output directory argument" , allow_path = True )
151157
152158if not os .path .isdir (sourcedir ):
153159 logging .error (f"{ sourcedir } does not exist" )
@@ -1221,4 +1227,4 @@ def cleanup_script_files():
12211227 os .chmod (outdir + "/clear" ,stat .S_IRWXU )
12221228 os .chmod (outdir + "/maxtime" ,stat .S_IRWXU )
12231229 os .chmod (outdir + "/params" ,stat .S_IRWXU )
1224- os .chmod (outdir + "/unlock" ,stat .S_IRWXU )
1230+ os .chmod (outdir + "/unlock" ,stat .S_IRWXU )
0 commit comments