2 ms·

Is it C's fault here though? Is it not just improper shell escaping? You could do that incorrectly in any language. If you're not quoting | and ` and stuff cor

• JdeBP 11y ago
  qmail has already been pointed to elsewhere in this discussion. One of the qmail security principles, which are fast approaching 20 years old, is the maxim: Don't parse. This is directly applicable here. * http://cr.yp.to/qmail/guarantee.html http://cr.yp.to/qmail/guarantee.html * http://cr.yp.to/qmail/qmailsec-20071101.pdf http://cr.yp.to/qmail/qmailsec-20071101.pdf The GNKSOA-MUA comes to mind, too. The other vulnerabilities (there being five -- see the mailing list message) are related to the idea of allowing input data files to contain embedded actions and commands to be executed by the data processing tool. In the world of mail there were many variations on this theme. Clifton T. Sharp Jr's Usenet signature was "Here, Outlook Express, run this program." "Okay, stranger.". * http://homepage.ntlworld.com./jonathan.deboynepollard/Proposals/gnksoa-mua.html#NoAutoFetchExternalContent http://homepage.ntlworld.com./jonathan.deboynepollard/Propos...