4 ms·
What possible reason could the authors have had to pass everything following a pipe into popen? Did they think they were writing a shell?
by fyolnish 12y ago
What possible reason could the authors have had to pass everything following a pipe into popen? Did they think they were writing a shell?
- deleted 12y ago[deleted]
- kps 12y agoWhen you're using ftp interactively, at the 'ftp>' prompt, you can optionally supply a local file name to the 'get' command, get remote-file [local-file] and that local-file can begin with a '|' to indicate that you want the remote file piped to a command, e.g. get README |less Apparently this handling of the interactive local file name was mistakenly applied to local files names derived from remote file names after an HTTP redirect from the command line. (Incidentally the interactive modes of ftp and telnet, with their 'command>' prompts, are the last vestiges in unix of TENEX on the ARPANET.)
- tlrobinson 12y agoVery reminiscent of Shellshock, actually. Never treat data as code unless very explicitly told to.
- ams6110 12y agoInteractive ftp is a shell, for file transfer operations.