5 ms·
Why is this a problem at all? There is no user supplied input here. There is some string mangling in commands below, but it looks like none of it can be manipul
by Rantenki 12y ago
Why is this a problem at all? There is no user supplied input here. There is some string mangling in commands below, but it looks like none of it can be manipulated by a malicious user. It's not a security issue. It sounds like OP just thinks that subprocesses are icky.
- peterwwillis 12y agoIt's not a problem. The poster didn't put a description of what the issue was, so I would say this post should be flagged, personally
- PeterWhittaker 12y agoWell, not necessarily. It would be much less of a problem if a) a full path name were provided and b) care was taken to ensure that the path name separator had not been overridden. As written, or with 'a' but not 'b', there may be a possibility of an attacker manipulating $PATH to cause their own identically-named executable to be invoked with Docker's own privileges.