Bug 703550: handle escaped percent chars in file access controls

The separating devices make a (fairly blunt) effort to avoid attempting to use
proscribed characters in file names for separations (for example, '/', '\',
etc). As part of this some characters can be replaced with escaped percent
chars - so the single percent character survives a later call to a formatted
string function (sprintf).

This ended up foxing the file access validation code which added the fully
escaped file name string to the permit write table, but later attempted to
validate a file name post sprintf, where the escaping had been undone.

So, add code to remove escape '%' characters before adding the string to the
file access permit lists.

1 files changed, 12 insertions, 1 deletions

diff --git a/base/gslibctx.c b/base/gslibctx.c
index 85e5a2d04..c12e624c2 100644
--- a/base/gslibctx.c
+++ b/base/gslibctx.c
@@ -629,7 +629,18 @@ rewrite_percent_specifiers(char *s)
             *s == 'X') {
             /* Success! */
             memset(match_start, '*', s - match_start + 1);
-            return;
+        }
+        /* If we have escaped percents ("%%") so the percent
+           will survive a call to sprintf and co, then we need
+           to drop the extra one here, because the validation
+           code will see the string *after* it's been sprintf'ed.
+         */
+        else if (*s == '%') {
+            char *s0 = s;
+            while (*s0) {
+                *s0 = *(s0 + 1);
+                s0++;
+            }
         }
     }
 }