3 ms·
>it wasn't just a simple passthrough to the usual C library mkdir() function Aren't standard I/O functions also vulnerable if you don't sanitize your inputs? Y
by kgeist 5y ago
>it wasn't just a simple passthrough to the usual C library mkdir() function
Aren't standard I/O functions also vulnerable if you don't sanitize your inputs? You can overwrite data and do all sorts of stuff. Sure forking a subprocess is more dangerous, but I think the real issue here is lack of input sanitization when calling OS functions, not the system() call per se.
- hanche 5y agoFor sure, in the case of mkdir() and fopen() you need to watch out for relative pathnames containing “../“. Is that the sort of thing you had in mind?
- christophilus 5y agoAnd semicolons, maybe other things: “myfanciuserinput.mp3 && pwned > /etc/hosts”
- greenyoda 5y agoThat syntax is interpreted by the shell. It means nothing to mkdir() (an OS-level API) or fopen() (a C library call).