* Fix not allow remote execution by adding PIPE_NOSHELL to the opening of a url by

    a browser.

1 files changed, 4 insertions, 3 deletions

diff --git a/pith/url.c b/pith/url.c
index 173cb879..114c60bf 100644
--- a/pith/url.c
+++ b/pith/url.c
@@ -53,7 +53,7 @@ char *
 rfc1738_scan(char *line, int *len)
 {
     char *colon, *start, *end;
-    int   n;
+    int   n, delim;
 
     /* process each : in the line */
     for(; (colon = strindex(line, ':')) != NULL; line = end){
@@ -137,6 +137,7 @@ rfc1738_scan(char *line, int *len)
 
 		if(i != j){
 		    *len = end - start;
+		    delim = start > line && *(start - 1) == '<';
 
 		    /*
 		     * Special case handling for comma.
@@ -146,8 +147,8 @@ rfc1738_scan(char *line, int *len)
 		     * In most cases any way, that's why we have the
 		     * exception.
 		     */
-		    if(*(end - 1) == ','
-		       || (*(end - 1) == '.' && (!*end  || *end == ' ')))
+		    if(delim == 0 && (*(end - 1) == ','
+		       || (*(end - 1) == '.' && (!*end  || *end == ' '))))
 		      (*len)--;
 
 		    if(*len - (colon - start) > 0)