Debian Patches
Status for docx2txt/1.4-7
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| 0001-shebangs.patch | shebangs | "Barak A. Pearlmutter" <barak+git@pearlmutter.net> | no | 2020-11-14 | ||
| 0002-no-shell-injection.patch | avoid shell and perl code injection docx2txt interpolated the input file name into backtick shell commands inside double quotes, so a file name containing ", $(...) or backticks executed arbitrary commands. Run unzip via a list-form pipe open instead, and prefix "./" to file names starting with "-" so they are not taken as unzip options. Use 3-argument open when reading from an extracted directory, where a directory name starting with "|" was run as a command, and when opening the output file. Create the temporary file used for STDIN input with File::Temp rather than at a predictable name opened without O_EXCL. Do not load docx2txt.config (which is perl code) from the current directory. |
Koyo Keiter <koyo.keiter@gmail.com> | no | debian | 2026-11-02 | |
| 0003-xml-whitespace.patch | tolerate insignificant whitespace in docx XML The text extraction is done with regular expressions that assume the compact XML written by most docx generators, so pretty-printed XML (or merely "<w:i />" with a space before the slash) was not recognised and raw XML leaked into the output. Normalise whitespace inside tags and drop whitespace-only text between tags, except directly inside <w:t> runs where it is content. |
"Barak A. Pearlmutter" <bap@debian.org> | no | debian | 2026-11-02 |