3 ms·
// Construct the command we want the $SHELL to execute let command = format!("cd {:?}; /usr/bin/env -0;", dir); SQL Injection-like attacks continues to res
by hn92726819 3y ago
// Construct the command we want the $SHELL to execute
let command = format!("cd {:?}; /usr/bin/env -0;", dir);
SQL Injection-like attacks continues to resurface. You should pass it as a parameter in the future. Untested, but something like this:
format!("cd \"$1\"; ...");
command.args([command, dir]);
- misternugget 3y agoRust's debug-print {:?} quotes the path here.
- hn92726819 3y agoYes, but rust's quoting does not match shell's quoting. Imagine a path like: $(rm -rf /*; echo /) That's a valid Unix path, but rust's quoting does nothing to stop it: https://play.rust-lang.org/?version=stable&mode=debug&edition=2021&gist=b04557b99c6acba32235d68053b8248c https://play.rust-lang.org/?version=stable&mode=debug&editio...