4 ms·
> When you send a string to the shell for execution, it seems reasonable to expect >, semi-colons, pipes, and other shell operators to be interpreted by the she
by matklad 5y ago
> When you send a string to the shell for execution, it seems reasonable to expect >, semi-colons, pipes, and other shell operators to be interpreted by the shell unless you escape them.
Fully agree here. But the problem is the second overload, which can take an array of strings (so looks like a safe API), but concatenates them without escaping.
- rvnx 5y agoAh, ah. I wanted to say no, but after reading more and more the method they offer is actually much more evil than it seems. In the ShellExecution function, if you actually comes from C programming you can get confused: Could the parameter "string | ShellQuotedString" mean: "A string which has the binary flag ShellQuotedString on" = "A shell quoted/escaped string" +/- "a string of sub-type ShellQuotedString" which would imply that the developer has to take this responsibility. or it means "string || ShellQuotedString", as in param is a "string OR ShellQuotedString" which in this case the behaviour is unknown. (well, now I know it's the second one :| ) but it's fun to read