From owner-freebsd-bugs Fri Jan 25 18:30: 8 2002 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 7393C37B400 for ; Fri, 25 Jan 2002 18:30:03 -0800 (PST) Received: (from gnats@localhost) by freefall.freebsd.org (8.11.6/8.11.6) id g0Q2U3s97703; Fri, 25 Jan 2002 18:30:03 -0800 (PST) (envelope-from gnats) Date: Fri, 25 Jan 2002 18:30:03 -0800 (PST) Message-Id: <200201260230.g0Q2U3s97703@freefall.freebsd.org> To: freebsd-bugs@FreeBSD.org Cc: From: hsaka@mth.biglobe.ne.jp (Hironori Sakamoto) Subject: Re: misc/34270: man -k could be used to execute any command. Reply-To: hsaka@mth.biglobe.ne.jp (Hironori Sakamoto) Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org The following reply was made to PR misc/34270; it has been noted by GNATS. From: hsaka@mth.biglobe.ne.jp (Hironori Sakamoto) To: keramida@freebsd.org Cc: bug-followup@freebsd.org, hsaka@mth.biglobe.ne.jp Subject: Re: misc/34270: man -k could be used to execute any command. Date: Sat, 26 Jan 2002 11:20:50 +0900 (JST) Hello, > From: Giorgos Keramidas > I changed the quotes used by system() to quote the command to double > quotes, and escape all double quotes in the shell command executed by > system() with a backslash. At least, '$', '`' and '\' should be quoted. I propose that all symbols and spaces (at lease, speical characters of /bin/sh) are quoted with '\' and the shell command is executed by system() without single/double quotes. Thank you, ------------------------------------------- Hironori SAKAMOTO http://www2u.biglobe.ne.jp/~hsaka/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message