Reaktor sed-plugin: remove sed script injection

Thanks @waldi for providing a breaking example: s/.\/\/; w /tmp/i

1 files changed, 3 insertions, 17 deletions

diff --git a/krebs/5pkgs/Reaktor/scripts/sed-plugin.py b/krebs/5pkgs/Reaktor/scripts/sed-plugin.py
index 8103c9585..22b48e59d 100644
--- a/krebs/5pkgs/Reaktor/scripts/sed-plugin.py
+++ b/krebs/5pkgs/Reaktor/scripts/sed-plugin.py
@@ -13,30 +13,16 @@ usr = environ['_from']
 import re
 
 def is_regex(line):
-    myre = re.compile(r'^s/((?:\\/|[^/])+)/((?:\\/|[^/])*)/([ig]*)$')
+    myre = re.compile(r'^s/(?:\\/|[^/])+/(?:\\/|[^/])*/[ig]?$')
     return myre.match(line)
 
 line = argv[1]
-m = is_regex(line)
 
-if m:
-    f,t,flagstr = m.groups()
-    fn = f.replace('\/','/')
-    tn = t.replace('\/','/')
-    flags =  0
-    count = 1
-    if flagstr:
-        if 'i' in flagstr:
-            flags = re.IGNORECASE
-        if 'g' in flagstr:
-            count = 0
-    else:
-        flagstr = ''
+if is_regex(line):
     last = d.get(usr,None)
     if last:
-        #print(re.sub(fn,tn,last,count=count,flags=flags))
         from subprocess import Popen,PIPE
-        p = Popen(['sed','s/{}/{}/{}'.format(f,t,flagstr)],stdin=PIPE,stdout=PIPE )
+        p = Popen(['sed',line],stdin=PIPE,stdout=PIPE)
         so,se = p.communicate(bytes("{}\n".format(last),"UTF-8"))
         if p.returncode:
             print("something went wrong when trying to process your regex: {}".format(se.decode()))