~ chicken-core (chicken-5) 58684f69572453acc6fed7326fa9df39be98760e

commit 58684f69572453acc6fed7326fa9df39be98760e
Author:     felix <felix@call-with-current-continuation.org>
AuthorDate: Tue Apr 16 23:30:29 2013 +0200
Commit:     Christian Kellermann <ckeen@pestilenz.org>
CommitDate: Sat Apr 20 21:54:32 2013 +0200

    qs uses single quotes instead of backslashing by blacklist
    
    Thanks to Florian Zumbiehl and sjamaan.
    
    Signed-off-by: Christian Kellermann <ckeen@pestilenz.org>

diff --git a/NEWS b/NEWS
index b013a84f..b81e8b92 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,9 @@
   - CVE-2013-1874: ./.csirc is no longer loaded from the current directory
     upon startup of csi, which could lead to untrusted code execution.
     (thanks to Florian Zumbiehl)
+  - On *nix, the qs procedure now single-quotes everything instead of relying
+    on a blacklist of shell characters to be escaped.  On Windows, it properly
+    duplicates double-quote characters.  (thanks to Florian Zumbiehl)
 
 - Tools
   - csc: added "-oi"/"-ot" options as alternatives to "-emit-inline-file"
diff --git a/setup-api.scm b/setup-api.scm
index 9309ca80..7370b568 100644
--- a/setup-api.scm
+++ b/setup-api.scm
@@ -237,7 +237,7 @@
   (cond ((string=? prg "csc")
 	 (string-intersperse 
 	  (cons*
-	   (shellpath (find-program "csc"))
+	   (find-program "csc")
 	   "-feature" "compiling-extension" 
 	   (if (or (deployment-mode)
 		   (and (feature? #:cross-chicken)
diff --git a/utils.scm b/utils.scm
index 94417fcc..77ccf565 100644
--- a/utils.scm
+++ b/utils.scm
@@ -59,20 +59,18 @@
 ;;; Quote string for shell
 
 (define (qs str #!optional (platform (build-platform)))
-  (case platform
-    ((mingw32)
-     (string-append "\"" str "\""))
-    (else
-     (if (zero? (string-length str))
-	 "''"
-	 (string-concatenate
-	  (map (lambda (c)
-		 (if (or (char-whitespace? c)
-			 (memq c '(#\# #\" #\' #\` #\´ #\~ #\& #\% #\$ #\! #\* #\;
-				   #\< #\> #\\ #\( #\) #\[ #\] #\{ #\} #\? #\|)))
-		     (string #\\ c)
-		     (string c)))
-	       (string->list str)))))))
+  (let ((delim (if (eq? platform 'mingw32) #\" #\'))
+	(escaped (if (eq? platform 'mingw32) "\"\"" "'\\''")))
+    (string-append
+     (string delim)
+     (string-concatenate
+      (map (lambda (c)
+	     (cond
+	      ((char=? c delim) escaped)
+	      ((char=? c #\nul) (error 'qs "NUL character can not be represented in shell string" str))
+	      (else (string c))))
+	   (string->list str)))
+     (string delim))))
 
 
 ;;; Compile and load file