3 ms·
Your quoting of "$0" does not protect it from the shell. An attacker need only provide an input such as: /tmp"; rm -rf /; " There are pipeline libraries that a
by joeyh 15y ago
Your quoting of "$0" does not protect it from the shell. An attacker need only provide an input such as: /tmp"; rm -rf /; "
There are pipeline libraries that avoid the shell for several languages. Some I can recommend:
* libpipeline http://libpipeline.nongnu.org/ http://libpipeline.nongnu.org/ easy, if somewhat verbose, pipeline construction in C.
* hsh https://github.com/jgoerzen/hsh/wiki https://github.com/jgoerzen/hsh/wiki makes pipelines in haskell, using operators so they really look like pipelines, but without involving the shell. Example: "ls -l" -|- "wc -l"
- sigil 15y agoYour quoting of "$0" does not protect it from the shell. An attacker need only provide an input such as: /tmp"; rm -rf /; " Not true. $ sh -c 'ls "$0"' '/tmp"; rm -rf /; "' ls: cannot access /tmp"; rm -rf /; ": No such file or directory If you were right, there would be no reasonable way to write shell scripts.
- joeyh 15y agoMy mistake, not knowing python's variable interpoltion well, I thought that the $0 was expanded by it, not the shell. Which, if it were the case, would indeed be vulnerable. Isn't it a bit harsh to downvote to -1 a comment which links to two completly on-topic libraries?
- sigil 15y agoI didn't downvote you, fwiw.
- NinetyNine 15y agoYour comment would be correct if it were PHP.