Re: first patch to security problem

[Peter <zed@linuxpower.org>]

On Sat, 26 Aug 2000, Decklin Foster wrote:

> > to  :      !netscape -remote 'openURL('%s')'
> 
> You can't be serious...
> 
> > +/* escapes \ $ ` ' " & | ; */
> 
> You forgot some metacharacters here, which is why this is a dangerous
> solution.

Like ?


> If I make a patch tomorrow to call execvp directly will you consider
> it?

Sure, but it's painfull. You'll have to worry about a argv[] array, and
$PATH.

-- 
Peter. <zed@linuxpower.org>

-
XChat-discuss: mailing list for XChat users
Archive:       http://mail.nl.linux.org/lists/
Posted By:     Peter <zed@linuxpower.org>