date: 2004-08-22T00:00:00.000Z
summary: Smiley theme installation lack of escaping
discoveredBy: A Gaim Crazy Patch Writer
To install a new smiley theme, a user can drag a tarball from a graphical file
manager, or a hypertext link to one from a web browser. When a tarball is
dragged, Gaim executes a shell command to untar it. However, it does not
escape the filename before sending it to the shell. Thus, a specially crafted
filename could execute arbitrary commands if the user could be convinced to
drag a file into the smiley theme selector.
Filenames are now escaped using
`g_shell_quote()`.