From cbb7f861e19c470e829422e94b489460f3178fd7 Mon Sep 17 00:00:00 2001
From: x3 <sugarpanning@cock.li>
Date: Thu, 14 Mar 2024 17:45:15 +0100
Subject: [PATCH] Escape ' character when executing script

---
 rss-watch.pl | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/rss-watch.pl b/rss-watch.pl
index 81b63a6..dc25b68 100755
--- a/rss-watch.pl
+++ b/rss-watch.pl
@@ -159,6 +159,12 @@ sub parse_config {
     close($fh);
 }
 
+sub sh_escape {
+    my ($txt) = @_;
+    $txt =~ s/'/'\\''/;
+    return $txt;
+}
+
 sub exec_script {
     my ($feed, $xmlitem) = @_;
 
@@ -171,7 +177,8 @@ sub exec_script {
             my $key = $1;
             #print("Matched: $key\n");
             next if not exists $xmlitem->{$key};
-            $cmd =~ s/\$$key/$xmlitem->{$key}/;
+            my $escaped_val = sh_escape($xmlitem->{$key});
+            $cmd =~ s/\$$key/$escaped_val/;
         }
 
         qx($cmd);