icecat: add release icecat-140.6.0-1gnu1 for aramo

icecat/devtools/client/shared/curl.js

@@ -160,16 +160,15 @@ const Curl = {
 
     // Format with line breaks if the command has more than 2 parts
     // e.g
-    // Command with 2 parts  - curl https://foo.com
+    // Command with 2 parts - curl https://foo.com
     // Commands with more than 2 parts -
     // curl https://foo.com
     // -X POST
     // -H "Accept : */*"
     // -H "accept-language: en-US"
     const joinStr = currentPlatform === "WINNT" ? " ^\n  " : " \\\n  ";
-    return (
-      "curl " + commandParts.join(commandParts.length >= 3 ? joinStr : " ")
-    );
+    const CMD = currentPlatform == "WINNT" ? "curl.exe " : "curl ";
+    return CMD + commandParts.join(commandParts.length >= 3 ? joinStr : " ");
   },
 };
 
@@ -421,10 +420,9 @@ const CurlUtils = {
       return "\\u" + ("0000" + code).substr(code.length, 4);
     }
 
-    // Escape & and |, which are special characters on Windows.
-    const winSpecialCharsRegEx = /([&\|])/g;
-
-    if (/[^\x20-\x7E]|\'/.test(str)) {
+    // Escape characters which are not within the charater range
+    // SPACE to "~"(char codes 32 - 126), the `!` (code 33) and '(code 39);
+    if (/[^\x20-\x7E]|!|\'/.test(str)) {
       // Use ANSI-C quoting syntax.
       return (
         "$'" +
@@ -434,14 +432,13 @@ const CurlUtils = {
           .replace(/\n/g, "\\n")
           .replace(/\r/g, "\\r")
           .replace(/!/g, "\\041")
-          .replace(winSpecialCharsRegEx, "^$1")
           .replace(/[^\x20-\x7E]/g, escapeCharacter) +
         "'"
       );
     }
 
     // Use single quote syntax.
-    return "'" + str.replace(winSpecialCharsRegEx, "^$1") + "'";
+    return "'" + str + "'";
   },
 
   /**
@@ -453,24 +450,22 @@ const CurlUtils = {
       Because cmd.exe parser and MS Crt arguments parsers use some of the
       same escape characters, they can interact with each other in
       horrible ways, the order of operations is critical.
+    
+      Also see https://ss64.com/nt/syntax-esc.html for details on
+      escaping characters on Windows.
     */
     const encapsChars = '^"';
     return (
       encapsChars +
       str
-        //  Replace \ with \\ first because it is an escape character for certain
-        // conditions in both parsers.
-        .replace(/\\/g, "\\\\")
-
-        // Escape double quotes with double slashes.
+        // Replace all " with \" to ensure the first parser does not remove it.
         .replace(/"/g, '\\"')
 
-        // Escape ` and $ so commands do not get executed e.g $(calc.exe) or `\$(calc.exe)
-        .replace(/[`$]/g, "\\$&")
-
         // Then escape all characters we are not sure about with ^ to ensure it
         // gets to MS Crt parser safely.
-        .replace(/[^a-zA-Z0-9\s_\-:=+~\/.',?;()*\$&\\{}\"`]/g, "^$&")
+        // Note: Also do not escape unicode control (C) non-printable characters
+        // https://www.compart.com/en/unicode/category (this is captured with `\p{C}` and the `u` unicode flag)
+        .replace(/[^-a-zA-Z0-9\s_:=+~\/.',?;()*`\p{C}]/gu, "^$&")
 
         // The % character is special because MS Crt parser will try and look for
         // ENV variables and fill them in its place. We cannot escape them with %
@@ -481,6 +476,14 @@ const CurlUtils = {
         // by the previous replace.
         .replace(/%(?=[a-zA-Z0-9_])/g, "%^")
 
+        // All other whitespace characters are replaced with a single space, as there
+        // is no way to enter their literal values in a command line, and they do break
+        // the command allowing for injection.
+        // Since want to keep line breaks, we need to exclude them in the regex (`[^\r\n]`),
+        // and use double negations to get the other whitespace chars (`[^\S]` translates
+        // to "not not whitespace")
+        .replace(/[^\S\r\n]/g, " ")
+
         // Lastly we replace new lines with ^ and TWO new lines because the first
         // new line is there to enact the escape command the second is the character
         // to escape (in this case new line).

icecat/devtools/client/shared/test/xpcshell/test_curl.js

@@ -347,9 +347,7 @@ const QUOTE = isWin() ? '^"' : "'";
 function quote(str) {
   let escaped;
   if (isWin()) {
-    escaped = str
-      .replace(new RegExp(QUOTE, "g"), `${QUOTE}${QUOTE}`)
-      .replace(/"/g, '\\"');
+    escaped = str.replace(new RegExp('"', "g"), `^\\${QUOTE}`);
   } else {
     escaped = str.replace(new RegExp(QUOTE, "g"), `\\${QUOTE}`);
   }
@@ -358,10 +356,10 @@ function quote(str) {
 
 function escapeNewline(txt) {
   if (isWin()) {
-    // Replace new lines with ^ and TWO new lines because the first
+    // For windows we replace new lines with ^ and TWO new lines because the first
     // new line is there to enact the escape command the second is the character
     // to escape (in this case new line).
-    return txt.replace(/\r?\n/g, "^\n\n");
+    return txt.replace(/\r?\n|\r/g, "^\n\n");
   }
   return txt.replace(/\r/g, "\\r").replace(/\n/g, "\\n");
 }
@@ -396,7 +394,8 @@ function inParams(curlParams, param) {
 function parseCurl(curlCmd) {
   // This monster regexp parses the command line into an array of arguments,
   // recognizing quoted args with matching quotes and escaped quotes inside:
+  // [ "curl.exe 'url'", "--standalone-arg", "-arg-with-quoted-string 'value\'s'" ]
   // [ "curl 'url'", "--standalone-arg", "-arg-with-quoted-string 'value\'s'" ]
-  const matchRe = /[-A-Za-z1-9]+(?: ([\^\\"']+)(?:\\\1|.)*?\1)?/g;
+  const matchRe = /[-\.A-Za-z1-9]+(?: ([\^\"']+)(?:\\\1|.)*?\1)?/g;
   return curlCmd.match(matchRe);
 }