From a96f41f6d6f0d8308d74a74d736d5a35dc54f0fa Mon Sep 17 00:00:00 2001
From: Sam Liddicott <sam@liddicott.com>
Date: Thu, 12 Sep 2024 17:18:37 +0100
Subject: use shlex.quote on KCONFIG_CONFIG_COMMAND for do_menuconfig

Although KCONFIG_CONFIG_COMMAND is shell-ready, it needs escaping
when composed as part of some shell which is then embedded into an
outer "sh -c" in cml1.bbclass

This patch uses shlex.quote to escape the entire shell fragment
when it is composed in the inner "sh -c"

Signed-off-by: Sam Liddicott <sam@liddicott.com>
---
 meta/classes-recipe/cml1.bbclass | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/classes-recipe/cml1.bbclass b/meta/classes-recipe/cml1.bbclass
index d319d66ab2..f6727c5c33 100644
--- a/meta/classes-recipe/cml1.bbclass
+++ b/meta/classes-recipe/cml1.bbclass
@@ -36,4 +36,5 @@ KCONFIG_CONFIG_ENABLE_MENUCONFIG ??= "true"
 KCONFIG_CONFIG_ROOTDIR ??= "${B}"
 python do_menuconfig() {
     import shutil
+    import shlex
 
@@ -48,5 +49,5 @@ python do_menuconfig() {
     # ensure that environment variables are overwritten with this tasks 'd' values
     d.appendVar("OE_TERMINAL_EXPORTS", " PKG_CONFIG_DIR PKG_CONFIG_PATH PKG_CONFIG_LIBDIR PKG_CONFIG_SYSROOT_DIR")
 
-    oe_terminal("sh -c 'make %s; if [ \\$? -ne 0 ]; then echo \"Command failed.\"; printf \"Press any key to continue... \"; read r; fi'" % d.getVar('KCONFIG_CONFIG_COMMAND'),
+    oe_terminal('sh -c %s' % shlex.quote("make %s; if [ $? -ne 0 ]; then echo 'Command failed.'; printf 'Press any key to continue... '; read r; fi" % d.getVar('KCONFIG_CONFIG_COMMAND')),
                 d.getVar('PN') + ' Configuration', d)
-- 
2.43.0
