From f9f28fc7c36b83fc7cace7cda272b430a9af422c Mon Sep 17 00:00:00 2001
From: warner <warner@lothar.com>
Date: Mon, 9 Oct 2006 01:48:35 +0100
Subject: [PATCH] security fix to contrib/svn_watcher.py

---
 CREDITS                |  1 +
 ChangeLog              |  9 +++++++++
 contrib/svn_watcher.py | 28 ++++++++++++++++++----------
 3 files changed, 28 insertions(+), 10 deletions(-)

diff --git a/CREDITS b/CREDITS
index 15f4f97..859349c 100644
--- a/CREDITS
+++ b/CREDITS
@@ -44,3 +44,4 @@ James Knight
 Albert Hofkamp
 Brett Neely
 Wade Brainerd
+Nick Mathewson
diff --git a/ChangeLog b/ChangeLog
index 10dd756..b09cd0e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2006-10-08  Brian Warner  <warner@lothar.com>
+
+	* contrib/svn_watcher.py: fix security holes by using proper argv
+	arrays and subprocess.Popen() rather than commands.getoutput().
+	Thanks to Nick Mathewson for the patch. Note that svn_watcher.py
+	is deprecated in favor of buildbot/changes/svnpoller.py, and will
+	probably be removed by the next release.
+	* CREDITS: add Nick
+
 2006-10-04  Brian Warner  <warner@lothar.com>
 
 	* buildbot/steps/python.py (PyFlakes.createSummary): skip any
diff --git a/contrib/svn_watcher.py b/contrib/svn_watcher.py
index ad18435..182a41d 100644
--- a/contrib/svn_watcher.py
+++ b/contrib/svn_watcher.py
@@ -16,7 +16,7 @@
 
 # 15.03.06 by John Pye
 # 29.03.06 by Niklaus Giger, added support to run under windows, added invocation option
-import commands
+import subprocess
 import xml.dom.minidom
 import sys
 import time
@@ -24,8 +24,13 @@ import os
 if sys.platform == 'win32':
     import win32pipe
 
+def getoutput(cmd):
+    p = subprocess.Popen(cmd, stdout=subprocess.PIPE)
+    return p.stdout.read()
+
 def checkChanges(repo, master, verbose=False, oldRevision=-1):
-    cmd ="svn log --non-interactive --xml --verbose --limit=1 "+repo
+    cmd = ["svn", "log", "--non-interactive", "--xml", "--verbose",
+           "--limit=1", repo]
     if verbose == True:
         print "Getting last revision of repository: " + repo
 
@@ -34,11 +39,11 @@ def checkChanges(repo, master, verbose=False, oldRevision=-1):
         xml1 = ''.join(f.readlines())
         f.close()
     else:
-        xml1 = commands.getoutput(cmd)  
-    
+        xml1 = getoutput(cmd)
+
     if verbose == True:
         print "XML\n-----------\n"+xml1+"\n\n"
-    
+
     doc = xml.dom.minidom.parseString(xml1)
     el = doc.getElementsByTagName("logentry")[0]
     revision = el.getAttribute("revision")
@@ -57,20 +62,23 @@ def checkChanges(repo, master, verbose=False, oldRevision=-1):
         print paths
 
     if  revision != oldRevision:
-        cmd = "buildbot sendchange --master="+master+" --revision=\""+revision+"\" --username=\""+author+"\"--comments=\""+comments+"\" "+" ".join(paths)
-    
+        cmd = ["buildbot", "sendchange", "--master=%s"%master,
+               "--revision=%s"%revision, "--username=%s"%author,
+               "--comments=%s"%comments]
+        cmd += paths
+
         if verbose == True:
             print cmd
-    
+
         if sys.platform == 'win32':
             f = win32pipe.popen(cmd)
             print time.strftime("%H.%M.%S ") + "Revision "+revision+ ": "+ ''.join(f.readlines())
             f.close()
         else:
-            xml1 = commands.getoutput(cmd)  
+            xml1 = getoutput(cmd)
     else:
         print time.strftime("%H.%M.%S ") + "nothing has changed since revision "+revision
-       
+
     return revision
 
 if __name__ == '__main__':
-- 
2.11.4.GIT