3 ms·
I think there's a security problem with this command. The command does not verify it's called as [xn--ts9h], it really needs to verify args[0] equals the name o
by Vecr 4y ago
I think there's a security problem with this command. The command does not verify it's called as [xn--ts9h], it really needs to verify args[0] equals the name of the command, otherwise you could call it though a link or mapping, etc. The article states that the name is important for security, so I'm submitting this bug as critical.
- xena 4y agohttps://github.com/Xe/xn--ts9h/commit/861f8fa86ef58cdc371b0eaeb71e921cef6e9235 https://github.com/Xe/xn--ts9h/commit/861f8fa86ef58cdc371b0e... I will make a new set of packages tomorrow because I am tired
- tracnar 4y agoLinux surprisingly allows you to exec a program with argc == 0, so you also want to check for that... https://lwn.net/Articles/882799/ https://lwn.net/Articles/882799/