Description: e -| instead of `...` to avoid shell injection. Report and fix from Claude.
Author: Paval Sanda <sanda@lyx.org>
Origin: upstream
Forwarded: not-needed
Applied-Upstream: https://svn.tug.org:8369/texlive?revision=79990&view=revision
Reviewed-by: Karl Berry  <karl@freefriends.org>
Last-Update: 2026-09-06
---
This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
--- xindy.orig/user-commands/xindy.in
+++ xindy/user-commands/xindy.in
@@ -804,7 +813,27 @@
 	push (@temp_files, $style_file);
 	$style_file=quotify($style_file);
 	foreach my $module ( @modules ) {
-	    print $sf "(require \"$module\")\n";
+	    if (($module =~ /\//) || ($module =~ /\\/)) {
+    # If $module contains directory separators, the module must be a system
+    # module. So we don't call kpsewhich.
+		print $sf "(require \"$module\")\n";
+	    } else {
+    # Here we call kpsewhich to search for a module. Thus modules can be under
+    # (anytexmf)/xindy/modules/
+		my $fnmodule;
+		# use -| form to avoid interpreting metacharacters.
+		if (open(my $kpse, '-|', 'kpsewhich',
+			 '-progname=xindy', '-format=othertext', $module)) {
+		    $fnmodule = <$kpse>;
+		    close($kpse);
+		}
+		if ($fnmodule) {
+		   chomp($fnmodule);
+		   print $sf "(require \"$fnmodule\")\n";
+		} else {
+		   print $sf "(require \"$module\")\n";
+		}
+	    }
 	}
 	close ($sf);
     }
