3 ms·
You are doing well I think. My comment was more about the situation where a newbie knows that he is handling dangerous operations but still copy-paste from Sta
by rvnx 5y ago
You are doing well I think.
My comment was more about the situation where a newbie knows that he is handling dangerous operations but still copy-paste from StackOverflow without even thinking or reading.
You went one-step ahead and wrote a summary so it wasn't about your situation.
The only point where I fundamentally disagree is about ShellExecution.
When you send a string to the shell for execution, it seems reasonable to expect >, semi-colons, pipes, and other shell operators to be interpreted by the shell unless you escape them.
- matklad 5y ago> When you send a string to the shell for execution, it seems reasonable to expect >, semi-colons, pipes, and other shell operators to be interpreted by the shell unless you escape them. Fully agree here. But the problem is the second overload, which can take an array of strings (so looks like a safe API), but concatenates them without escaping.
- rvnx 5y agoAh, ah. I wanted to say no, but after reading more and more the method they offer is actually much more evil than it seems. In the ShellExecution function, if you actually comes from C programming you can get confused: Could the parameter "string | ShellQuotedString" mean: "A string which has the binary flag ShellQuotedString on" = "A shell quoted/escaped string" +/- "a string of sub-type ShellQuotedString" which would imply that the developer has to take this responsibility. or it means "string || ShellQuotedString", as in param is a "string OR ShellQuotedString" which in this case the behaviour is unknown. (well, now I know it's the second one :| ) but it's fun to read