From 28eec73eedd80be56adf23e666e5d99e25d4631e Mon Sep 17 00:00:00 2001
From: "James R. Barlow" <james@purplerock.ca>
Date: Thu, 24 Sep 2020 16:43:31 -0700
Subject: [PATCH] Tighten unpaper-args validation to exclude . and ..

Just in case
---
 src/ocrmypdf/_exec/unpaper.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ocrmypdf/_exec/unpaper.py b/src/ocrmypdf/_exec/unpaper.py
index 6b4383d1..7b797891 100644
--- a/src/ocrmypdf/_exec/unpaper.py
+++ b/src/ocrmypdf/_exec/unpaper.py
@@ -107,7 +107,7 @@ def run(input_file, output_file, dpi, mode_args):
 
 def validate_custom_args(args: str):
     unpaper_args = shlex.split(args)
-    if any('/' in arg for arg in unpaper_args):
+    if any(('/' in arg or arg == '.' or arg == '..') for arg in unpaper_args):
         raise ValueError('No filenames allowed in --unpaper-args')
     return unpaper_args