[DGD]External commands

[Matthew Jenkins]

On Sat, 31 Mar 2001, Erwin Harte wrote:

> On Sat, Mar 31, 2001 at 04:47:22PM +0100, Matthew Jenkins wrote:
> > 
> > On Sat, 31 Mar 2001, Erwin Harte wrote:
> > 
> [...]
> > 
> > > - What if this is called with 'foo | rm -rf /' as 5th parameter?
> > 
> > then you email someone the message "foo | rm -rf /".
> 
> Uhm.  Ok, my mistake, let me rephrase:
> 
> What if f->sp[4].u.string->text contains the text "foo | rm -rf /" as
> contents?  Do you check for that?
> 
> |        sprintf(command,"sendmail -bs -F%s <tmail >tmail.out",
> |                f->sp[4].u.string->text);
> |        system(command);
> 
> You'd end up with:
> 
>   "sendmail -bs -Ffoo | rm -rf / <tmail >tmail.out"
> 
> How do you think system() is going to interpret that?
> 
> It's not that I think you don't care, but keep in mind that while you
> are using this on a game where you are apparently the only one in
> charge, if you're offering the code to others who are not, they might
> not be aware of these flaws and find their games/computers hacked or
> supposedly private email monitored by third parties who should not be
> able to.

Like I said - it can probably be improved - but it does what I want it
to...

> 
> Please be careful.
> 
> Erwin.
> -- 
> Erwin Harte      : `Don't mind Erwin, he gets crabby. :)'
> harte at xs4all.nl  :    -- Par Winzell <zell at skotos.net>
> 
> List config page:  http://list.imaginary.com/mailman/listinfo/dgd
> 


List config page:  http://list.imaginary.com/mailman/listinfo/dgd