4 ms·
Hi Your software is broken by assuming a command can be split up into arguments by spaces, and also not letting the os package properly escape your arguments.
by noasiwiwiwu 9y ago
Hi
Your software is broken by assuming a command can be split up into arguments by spaces, and also not letting the os package properly escape your arguments.
https://github.com/amalfra/oexec/blob/master/oexec.go#L48 https://github.com/amalfra/oexec/blob/master/oexec.go#L48
Here's a command that would be impossible to execute with your software, notice how the last argument is a single argument:
c := exec.Command(
"/usr/bin/osascript",
"-e",
"say 5")
output, err := c.CombinedOutput()
- amalfra 9y agoThanks for pointing it out. Won't quoting the command in the package's function call itself work, for eg: outs := oexec.Series("/usr/bin/osascript -e 'say 5'") I think even when running command in shell prompt arguments with space are supposed to be escaped with quotes