Correctly escape everything from heredoc

1 files changed, 7 insertions, 13 deletions

@@ -14,19 +14,6 @@ BEGIN {
         ATTR = DEFATTR
 }
 
-# Sure, let's do templating!  This makes it less... weird.
-# This has to come before raw handling so that code doesn't get expanded in raw sections.
-/\$/ {
-        if (RAW) {
-                gsub(/\$/, "\\\\&", $0)
-        } else {
-                # XXX: This is probably the dumbest way to do it.
-                gsub(/\$\$/, "$\a", $0)
-                gsub(/\$[^\a]/, "\\\\&", $0)
-                gsub(/\$\a/, "$", $0)
-        }
-}
-
 # Handle raw sections
 $0 ~ CONFIG["raw_delim"] {
         RAW = ! RAW
@@ -45,6 +32,7 @@ $0 ~ CONFIG["raw_delim"] {
 }
 
 RAW {
+        gsub(/[\\\$]/, "\\\\&", $0)
         bufpush(html_escape($0))
         next
 }
@@ -70,6 +58,7 @@ $0 ~ ("^" COMMENT_DELIM) {
         } else {
                 sep = "\n"
         }
+        gsub(/\\/, "\\\\", $0)
         $0 = html_escape($0)
         # Loop through BLOCK_TYPES
         for (bt in BLOCK_TYPES) {
@@ -141,6 +130,11 @@ $0 ~ ("^" COMMENT_DELIM) {
                         $0 = templ
                 }
         }
+        # Escape stuff for the shell -- allow $$ to expand
+        gsub(/\$\$/, "$\a", $0)
+        gsub(/\$[^\a]/, "\\\\&", $0)
+        gsub(/\$\a/, "$", $0)
+        gsub(/`/, "\\`", $0)
         # Push to buffer
         bufpush($0, sep)
 }