From 3169c1e7a2c6acc4c59dfcf8b089896d6881925b Mon Sep 17 00:00:00 2001 From: Paul Eggert Date: Thu, 23 Apr 2026 09:20:43 -0700 Subject: [PATCH] html: use xsltproc from PATH MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * src/print-xml.c (print_html): * src/reader.c (prepare_percent_define_front_end_variables): Drop undocumented support for lines like ‘%define tool.xsltproc "whatever"’, as this can cause more trouble than it cures. CVE: CVE-2026-56389 Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/bison.git/commit/?id=3169c1e7a2c6acc4c59dfcf8b089896d6881925b] Signed-off-by: Peter Marko --- src/print-xml.c | 4 +--- src/reader.c | 1 - 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/src/print-xml.c b/src/print-xml.c index 8da6da0d..79bfa88d 100644 --- a/src/print-xml.c +++ b/src/print-xml.c @@ -543,10 +543,9 @@ print_html (void) assert (xml_flag); char *xml2html = xpath_join (pkgdatadir (), "xslt/xml2xhtml.xsl"); - char *xsltproc = muscle_percent_define_get ("tool.xsltproc"); char const *argv[11]; int i = 0; - argv[i++] = xsltproc; + argv[i++] = "xsltproc"; argv[i++] = "-o"; argv[i++] = spec_html_file; argv[i++] = xml2html; @@ -572,6 +571,5 @@ print_html (void) /* termsigp */ NULL); if (status) complain (NULL, complaint, _("%s failed with status %d"), argv[0], status); - free (xsltproc); free (xml2html); } diff --git a/src/reader.c b/src/reader.c index 862d7293..cb2a7f69 100644 --- a/src/reader.c +++ b/src/reader.c @@ -788,7 +788,6 @@ prepare_percent_define_front_end_variables (void) muscle_percent_define_default ("lr.default-reduction", "accepting"); free (lr_type); } - muscle_percent_define_default ("tool.xsltproc", "xsltproc"); /* Check %define front-end variables. */ {