Xavier RocheandClaude Opus 5
c47fc15c9c
`-V` runs a shell command for each saved page, with `$0` standing for the file name. That name comes from a crawled URL, so it can hold `;`, backticks, `$`, `&`, quotes and spaces. The engine pasted it into the command text and handed the result to `system()`, so a page saved as `a;rm -rf ~;.html` ran what its name said. The name is an argument now. Each `$0` becomes a reference to the shell's first positional parameter. The engine forks and execs `sh -c <command> sh <name>`, so the name arrives as `$1` and is never parsed as code. A parameter is read as data in a plain word, inside `"..."` and inside `'...'`. Everywhere else the shell reads the text again. Enumerating which of those places is dangerous does not converge, and six review rounds found six live executions. So `$0` expands in those three positions and every other region refuses, which costs some templates that used to run. All six documented templates put `$0` plain or inside `"..."`, so none of them is affected. Three things a reviewer should know. A template writing `$1`, `$@` or `$#` used to see an empty parameter list and now sees the file name. One limit stays, and the man page now names it. `let`, `declare -i` and `eval` evaluate their argument as an expression, so they read the file name as code. And Windows keeps `system()`, because `cmd /c` has no positional parameters to hand the name to. Finding originally reported by @sparktron in #1693 (closed). --------- Signed-off-by: Xavier Roche <roche@httrack.com> Signed-off-by: Xavier Roche <xroche@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
HTTrack Website Copier - Development Repository
About
Copy websites to your computer (Offline browser)
HTTrack is an offline browser utility, allowing you to download a World Wide website from the Internet to a local directory, building recursively all directories, getting html, images, and other files from the server to your computer.
HTTrack arranges the original site's relative link-structure. Simply open a page of the "mirrored" website in your browser, and you can browse the site from link to link, as if you were viewing it online.
HTTrack can also update an existing mirrored site, and resume interrupted downloads. HTTrack is fully configurable, and has an integrated help system.
WinHTTrack is the Windows front end and WebHTTrack the one for Linux, BSD and macOS, where it also arrives with brew install httrack and in the release DMG. There is an Android app too, and underneath all of them the httrack command line.
Website
Main Website: https://www.httrack.com/
Compile trunk release
A git checkout ships only the autotools sources, so ./bootstrap (which runs
autoreconf) regenerates configure first; this needs autoconf, automake and
libtool. Released tarballs already include configure, so building from a
tarball skips ./bootstrap.
git clone https://github.com/xroche/httrack.git --recurse-submodules
cd httrack
./bootstrap
./configure --prefix=$HOME/usr && make -j8 && make install
Or use the one-shot wrapper (bootstrap + configure + make), which forwards its
arguments to configure:
./build.sh --prefix=$HOME/usr