Commit message: disable Uzbl javascript object because of security problem.
CVE: CVE-2010-0011
CWE: CWE-264
Vulnerability description: The eval_js function in uzbl-core.c in Uzbl before 2010.01.05 exposes the run method of the Uzbl object, which allows remote attackers to execute arbitrary commands via JavaScript code.

Project: uzbl

test_run_handler_arg_order (void) {
    run_handler("sync_spawn echo uvw xyz", "abc def");

    assert(uzbl.comm.sync_stdout);

    /* the result should begin with the standard handler arguments */
    gchar *rest = assert_sync_beginswith_stdarg();

    /* the rest of the result should be the arguments passed to run_handler. */
    /* the arguments in the second argument to run_handler should be placed before any
     * included in the first argument to run handler. */
    g_assert_cmpstr("abc def uvw xyz\n", ==, rest);
}

Project: uzbl

create_mainbar () {
    GUI *g = &uzbl.gui;

    g->mainbar = gtk_hbox_new (FALSE, 0);
    g->mainbar_label = gtk_label_new ("");
    gtk_label_set_selectable((GtkLabel *)g->mainbar_label, TRUE);
    gtk_label_set_ellipsize(GTK_LABEL(g->mainbar_label), PANGO_ELLIPSIZE_END);
    gtk_misc_set_alignment (GTK_MISC(g->mainbar_label), 0, 0);
    gtk_misc_set_padding (GTK_MISC(g->mainbar_label), 2, 2);
    gtk_box_pack_start (GTK_BOX (g->mainbar), g->mainbar_label, TRUE, TRUE, 0);

    g_object_connect((GObject*)g->mainbar,
      "signal::key-press-event",                    (GCallback)key_press_cb,    NULL,
      "signal::key-release-event",                  (GCallback)key_release_cb,  NULL,
      NULL);

    return g->mainbar;
}

Project: uzbl

init_socket(gchar *dir) { /* return dir or, on error, free dir and return NULL */
    if (uzbl.comm.socket_path) { /* remove an existing socket should one exist */
        if (unlink(uzbl.comm.socket_path) == -1)
            g_warning ("init_socket: couldn't unlink socket at %s\n", uzbl.comm.socket_path);
        g_free(uzbl.comm.socket_path);
        uzbl.comm.socket_path = NULL;
    }

    if (*dir == ' ') {
        g_free(dir);
        return NULL;
    }

    GIOChannel *chan = NULL;
    int sock, len;
    struct sockaddr_un local;
    gchar *path = build_stream_name(SOCKET, dir);

    sock = socket (AF_UNIX, SOCK_STREAM, 0);

    local.sun_family = AF_UNIX;
    strcpy (local.sun_path, path);
    unlink (local.sun_path);

    len = strlen (local.sun_path) + sizeof (local.sun_family);
    if (bind (sock, (struct sockaddr *) &local, len) != -1) {
        if (uzbl.state.verbose)
            printf ("init_socket: opened in %s\n", path);
        listen (sock, 5);

        if( (chan = g_io_channel_unix_new(sock)) ) {
            g_io_add_watch(chan, G_IO_IN|G_IO_HUP, (GIOFunc) control_socket, chan);
            uzbl.comm.socket_path = path;
            send_event(SOCKET_SET, path, NULL);
            return dir;
        }
    } else g_warning ("init_socket: could not open in %s: %s\n", path, strerror(errno));

    /* if we got this far, there was an error; cleanup */
    g_free(path);
    g_free(dir);
    return NULL;
}

Project: uzbl

initialize(int argc, char *argv[]) {
    int i;

    for(i=0; i<argc; ++i) {
        if(!strcmp(argv[i], "-s") || !strcmp(argv[i], "--socket")) {
            uzbl.state.plug_mode = TRUE;
            break;
        }
    }

    if (!g_thread_supported ())
        g_thread_init (NULL);
    gtk_init (&argc, &argv);

    uzbl.state.executable_path = g_strdup(argv[0]);
    uzbl.state.selected_url = NULL;
    uzbl.state.searchtx = NULL;

    GOptionContext* context = g_option_context_new ("[ uri ] - load a uri by default");
    g_option_context_add_main_entries (context, entries, NULL);
    g_option_context_add_group (context, gtk_get_option_group (TRUE));
    g_option_context_parse (context, &argc, &argv, NULL);
    g_option_context_free(context);

    if (uzbl.behave.print_version) {
        printf("Commit: %s\n", COMMIT);
        exit(EXIT_SUCCESS);
    }

    uzbl.net.soup_session = webkit_get_default_session();
    uzbl.state.keycmd = g_strdup("");

    for(i=0; sigs[i]; i++) {
        if(setup_signal(sigs[i], catch_signal) == SIG_ERR)
            fprintf(stderr, "uzbl: error hooking %d: %s\n", sigs[i], strerror(errno));
    }
    event_buffer_timeout(10);

    uzbl.info.webkit_major = WEBKIT_MAJOR_VERSION;
    uzbl.info.webkit_minor = WEBKIT_MINOR_VERSION;
    uzbl.info.webkit_micro = WEBKIT_MICRO_VERSION;
    uzbl.info.arch         = ARCH;
    uzbl.info.commit       = COMMIT;

    commands_hash ();
    create_var_to_name_hash();

    create_mainbar();
    create_browser();
}

Project: uzbl

itos(int val) {
    char tmp[20];

    snprintf(tmp, sizeof(tmp), "%i", val);
    return g_strdup(tmp);
}

Project: uzbl

parse_command(const char *cmd, const char *param, GString *result) {
    CommandInfo *c;
    GString *tmp = g_string_new("");

    if ((c = g_hash_table_lookup(uzbl.behave.commands, cmd))) {
            guint i;
            gchar **par = split_quoted(param, TRUE);
            GArray *a = g_array_new (TRUE, FALSE, sizeof(gchar*));

            if (c->no_split) { /* don't split */
                sharg_append(a, param);
            } else if (par) {
                for (i = 0; i < g_strv_length(par); i++)
                    sharg_append(a, par[i]);
            }

            if (result == NULL) {
                GString *result_print = g_string_new("");

                c->function(uzbl.gui.web_view, a, result_print);
                if (result_print->len)
                    printf("%*s\n", (int)result_print->len, result_print->str);

                g_string_free(result_print, TRUE);
            } else {
                c->function(uzbl.gui.web_view, a, result);
            }
            g_strfreev (par);
            g_array_free (a, TRUE);

            if(strcmp("set", cmd)     &&
               strcmp("event", cmd)   &&
               strcmp("request", cmd)) {
                g_string_printf(tmp, "%s %s", cmd, param?param:"");
                send_event(COMMAND_EXECUTED, tmp->str, NULL);
                g_string_free(tmp, TRUE);
            }
    }
    else {
        gchar *tmp = g_strdup_printf("%s %s", cmd, param?param:"");
        send_event(COMMAND_ERROR, tmp, NULL);
        g_free(tmp);
    }
}

Project: uzbl

spawn_sync(WebKitWebView *web_view, GArray *argv, GString *result) {
    (void)web_view; (void)result;
    gchar *path = NULL;

    if (argv_idx(argv, 0) &&
            ((path = find_existing_file(argv_idx(argv, 0)))) ) {
        run_command(path, 0,
                ((const gchar **) (argv->data + sizeof(gchar*))),
                    TRUE, &uzbl.comm.sync_stdout);
        g_free(path);
    }
}