parameters ending with '\' causes python to bomb

[Amphi-users]

Steps to reproduce:
-use any extension where you can enter some string (eg
effects->color->custom...)
-put a backslash at the end
-run it

The interpreter will bomb (prior to reaching the extension code) with:

IOError: [Errno 9] Bad file descriptor

[Prokoudine (prokoudine)]

Originator: NO

Confirmed on SVN revision 16423

[Simon Dahlbacka (simon-dahlbacka)]

FWIW, on Win Vista x86 using Inkscape0802261840-fulldbg.7z I instead get the following python traceback:
Traceback (most recent call last):
  File "share\extensions\color_custom.py", line 25, in <module>
    c.affect()
  File "c:\Download\Inkscape0802261840-fulldbg\inkscape\share\extensions\inkex.py", line 154, in affect
    self.effect()
  File "c:\Download\Inkscape0802261840-fulldbg\inkscape\share\extensions\coloreffect.py", line 39, in effect
    self.getAttribs(node)
  File "c:\Download\Inkscape0802261840-fulldbg\inkscape\share\extensions\coloreffect.py", line 42, in getAttribs
    self.changeStyle(node)
  File "c:\Download\Inkscape0802261840-fulldbg\inkscape\share\extensions\coloreffect.py", line 55, in changeStyle
    styles[i]=color_props[c]+self.process_prop(styles[i][len(color_props[c]):])
  File "c:\Download\Inkscape0802261840-fulldbg\inkscape\share\extensions\coloreffect.py", line 63, in process_prop
    col='#'+self.colmod(c[0],c[1],c[2])
  File "share\extensions\color_custom.py", line 19, in colmod
    r2=self.normalize(eval(self.options.rFunction))
  File "<string>", line 1
    r\
    ^
SyntaxError: unexpected character after line continuation character

[theAdib (theadib)]

any character that breaks the XML bombs python.
<,>,\, even ä,ö,ü will do so.
those strings need to XML-ized before transferring to the script

[Alexander Gessler (alexander-gessler)]

I get Simon's result as well running [extensions-color-custom]. It's impossible to enter a formula with the 'live update' box checked because python's `eval()` breaks on incomplete stuff like 'r+'. I've attached a patch to swallow any exceptions and set the color to RED while the formula is invalid, in the hope that red is universally recognized as signal color. Also, eval is now guarded to prevent unwanted propagation of the python namespace into the function entry box. Tested with python2.6 on Ubuntu 10.4 amd64 and WinVista x86.

This is my first inkscape patch, I hope the diff works! I'm not sure how this is related to the original bug description. I think the only problem here is the `eval`.

[Alexander Gessler (alexander-gessler)]

Apologies for bumping, but has anybody seen this?

[jazzynico (jazzynico)]

Patch committed in the trunk, revision 9727.
Thanks Alexander; it works perfectly now!

This extension is not very intuitive, and it would be nice to have a few words of explanation. It probably needs an help tab...

Is there another extension known for crashing when using invalid characters?

[Alvin Penner (apenner)]

a similar problem occurred in Function Plotter, Bug 590079. Patch by Daniel Blueman committed to bzr 9631. Wouldn't surprise me if there were others not yet diagnosed.

[Neon22 (neon22)]

This patch does not appear to have made it to the 0.48 release.
Just checked color_custom.py and its not fixed :-(
(Same for the Function plotter bug mentioned above but its marked for 0.49)

[su_v (suv-lp)]

> (Same for the Function plotter bug mentioned above but its marked for 0.49)

Both bugs (bug #168417, bug #590079) are milestoned for Inkscape 0.49.

[su_v (suv-lp)]

Adding 'backport-proposed' with regard to revision 9727 (see also new duplicate bug #849046).

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "custom_color.diff" of this bug report has been identified as being a patch. The ubuntu-reviewers team has been subscribed to the bug report so that they can review the patch. In the event that this is in fact not a patch you can resolve this situation by removing the tag 'patch' from the bug report and editing the attachment so that it is not flagged as a patch. Additionally, if you are member of the ubuntu-sponsors please also unsubscribe the team from this bug report.

[This is an automated message performed by a Launchpad user owned by Brian Murray. Please contact him regarding any issues with the action taken in this bug report.]

[jazzynico (jazzynico)]

bug #590079 fix already release in 0.48.2.
Custom color backport in progress.

[jazzynico (jazzynico)]

Custom color fix committed in the branch, revision 9837.

[Launchpad Janitor (janitor)]

This bug was fixed in the package inkscape - 0.48.3-0ubuntu1

---------------
inkscape (0.48.3-0ubuntu1) precise; urgency=low

  * New upstream release (LP: #933188). Fixes several Ubuntu bugs:
    - inkscape fails to build with glib 2.31 (LP: #898538)
    - ctrl c ctrl v of text in edit mode crashes inkscape (LP: #496793)
    - Completely replace lcms1 by lcms2 in Ubuntu (LP: #885324)
    - parameters ending with '\' causes python to bomb (LP: #168417)
    - Extensions with <check> tags fail to load (LP: #668895)
    - ESC doesn't cancel move when using the Node Tool (LP: #788560)
    - unable to edit attributes in Inkscape XML Editor (LP: #884368)
    - Some layers should be visible by default in Layers dialog (LP: #902054)
    - Path Effect List is hidden (LP: #909958)
    - Input Devices > Hardware > Tree of devices is hidden (LP: #910467)
    - Glyphs Font styles are hidden (LP: #911079)
    - Error messages from Extensions hidden (LP: #911079)
    - Messages dialog doesn't work (LP: #911123)
  * Drop 02-add-shebangs-and-fix-permissions.dpatch: Applied upstream.
  * Drop build-dependency on specific libwpd/libwpg version.
 -- Alex Valavanis <email address hidden> Thu, 16 Feb 2012 14:33:40 +0000