https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb04660f333.patch
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14500

From 26f5a4350f3ab5507bb8727051c87bb04660f333 Mon Sep 17 00:00:00 2001
From: Alexander Batischev <eual.jp@gmail.com>
Date: Sat, 16 Sep 2017 19:31:43 +0300
Subject: [PATCH] Work around shell code in podcast names (#598)

---
 src/pb_controller.cpp | 6 +++---
 src/queueloader.cpp   | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/pb_controller.cpp b/src/pb_controller.cpp
index 09b5e897..213216cd 100644
--- a/src/pb_controller.cpp
+++ b/src/pb_controller.cpp
@@ -306,9 +306,9 @@ void pb_controller::play_file(const std::string& file) {
 	if (player == "")
 		return;
 	cmdline.append(player);
-	cmdline.append(" \"");
-	cmdline.append(utils::replace_all(file,"\"", "\\\""));
-	cmdline.append("\"");
+	cmdline.append(" \'");
+	cmdline.append(utils::replace_all(file,"'", "%27"));
+	cmdline.append("\'");
 	stfl::reset();
 	LOG(LOG_DEBUG, "pb_controller::play_file: running `%s'", cmdline.c_str());
 	::system(cmdline.c_str());
diff --git a/src/queueloader.cpp b/src/queueloader.cpp
index c1dabdd8..ae725e04 100644
--- a/src/queueloader.cpp
+++ b/src/queueloader.cpp
@@ -130,7 +130,7 @@ std::string queueloader::get_filename(const std::string& str) {
 		strftime(lbuf, sizeof(lbuf), "%Y-%b-%d-%H%M%S.unknown", localtime(&t));
 		fn.append(lbuf);
 	} else {
-		fn.append(base);
+		fn.append(utils::replace_all(base, "'", "%27"));
 	}
 	return fn;
 }
m class='right' method='get' action='/guix/log/etc/openrc'>
<input type='hidden' name='id' value='9d45783d777eda4874570f5cba29a9e4be9a0abf'/><input type='hidden' name='showmsg' value='1'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=9d45783d777eda4874570f5cba29a9e4be9a0abf&amp;showmsg=1'>root</a>/<a href='/guix/log/etc?id=9d45783d777eda4874570f5cba29a9e4be9a0abf&amp;showmsg=1'>etc</a>/<a href='/guix/log/etc/openrc?id=9d45783d777eda4874570f5cba29a9e4be9a0abf&amp;showmsg=1'>openrc</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/etc/openrc?id=9d45783d777eda4874570f5cba29a9e4be9a0abf'>Collapse</a>)</th><th class='left'>Author</th></tr>
<tr class='logheader'><td><span title='2021-07-07 23:54:20 -0400'>2021-07-07</span></td><td class='logsubject'><a href='/guix/commit/etc/openrc?id=4cbe0127a668cbcc64087c5d311308b59d39b104'>guix-install.sh: Prompt for configuring substitutes discovery.</a></td><td>Maxim Cournoyer</td></tr>
<tr class='nohover-highlight'><td/><td colspan='3' class='logmsg'>
Also ensure prompt_yes_no always print the message with a trailing space,
which is more pleasing to the eye.

* etc/guix-daemon.conf.in &lt;--discover=no&gt;: New guix-daemon option.
* etc/guix-daemon.service.in: Likewise.
* etc/init.d/guix-daemon.in: Likewise.
* etc/openrc/guix-daemon.in: Likewise.
* etc/guix-install.sh (configure_substitute_discovery): New procedure.
(sys_enable_guix_daemon): Ask the user whether automatic substitute discovery
should be enabled.  Set the '--discover' argument accordingly.
(prompt_yes_no): Add a trailing space to the message.
(sys_authorize_build_farms): Remove trailing space from the message argument.
* NEWS (Distribution): Add news.


</td></tr>
<tr class='logheader'><td><span title='2020-09-17 14:10:42 +0200'>2020-09-17</span></td><td class='logsubject'><a href='/guix/commit/etc/openrc?id=cabac732deffafc796537658a6c33c6c4aec821e'>guix-install.sh: Support OpenRC.</a></td><td>Morgan Smith</td></tr>
<tr class='nohover-highlight'><td/><td colspan='3' class='logmsg'>
* etc/guix-install.sh (chk_init_sys): Detect OpenRC.
(sys_enable_guix_daemon): Install &amp; enable the Guix daemon on such
systems.
* etc/openrc/guix-daemon.in: New file.
* nix/local.mk: Add a rule for it.
(openrcservicedir, nodist_openrcservice_DATA): New variables.
(CLEANFILES, EXTRA_DIST): Add them.
* .gitignore: Ignore etc/openrc/guix-daemon.

Signed-off-by: Tobias Geerinckx-Rice &lt;me@tobias.gr&gt;


</td></tr>