From 56ba1e72c7f3cc3a1859b38bd52fbb682d3da46d Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Thu, 23 Apr 2026 18:21:08 +0200
Subject: [PATCH 25/38] CVE-2026-4480/CVE-2026-4408: lib/util: add more unsafe
 characters to STRING_SUB_UNSAFE_CHARACTERS

|&<> are unsafe characters for shell processing.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16033
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
---
 lib/util/substitute.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/util/substitute.h b/lib/util/substitute.h
index b183d864671..41f56c73ba2 100644
--- a/lib/util/substitute.h
+++ b/lib/util/substitute.h
@@ -26,7 +26,7 @@
 
 #include <talloc.h>
 
-#define STRING_SUB_UNSAFE_CHARACTERS "$`\"';%"
+#define STRING_SUB_UNSAFE_CHARACTERS "$`\"';%|&<>"
 
 /**
  Substitute a string for a pattern in another string. Make sure there is
-- 
2.43.0


