From fa485e8fc5adfbfce28af865c689376840562bab Mon Sep 17 00:00:00 2001 From: Adrian Vovk Date: Sun, 4 Feb 2024 12:18:08 -0500 Subject: [PATCH] locale-util: Restrict valid locales This further restricts the charset of locales to better reflect what locales actually look like. This allows us to safely join locale names using the `:` character, for instance, which cannot appear in a locale name and is used by the `$LANGUAGE` env var --- src/basic/locale-util.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/basic/locale-util.c b/src/basic/locale-util.c index 9e70c3f01f..e6da5dbc63 100644 --- a/src/basic/locale-util.c +++ b/src/basic/locale-util.c @@ -260,7 +260,10 @@ bool locale_is_valid(const char *name) { if (!filename_is_valid(name)) return false; - if (!string_is_safe(name)) + /* Locales look like: ll_CC.ENC@variant, where ll and CC are alphabetic, ENC is alphanumeric with + * dashes, and variant seems to be alphabetic. + * See: https://www.gnu.org/software/gettext/manual/html_node/Locale-Names.html */ + if (!in_charset(name, ALPHANUMERICAL "_.-@")) return false; return true;