Date: Sat, 26 Jan 2002 09:40:02 -0800 (PST) From: Giorgos Keramidas <keramida@freebsd.org> To: freebsd-bugs@FreeBSD.org Subject: Re: misc/34270: man -k could be used to execute any command. Message-ID: <200201261740.g0QHe2107512@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR misc/34270; it has been noted by GNATS.
From: Giorgos Keramidas <keramida@freebsd.org>
To: "Crist J. Clark" <cjc@freebsd.org>
Cc: bug-followup@freebsd.org
Subject: Re: misc/34270: man -k could be used to execute any command.
Date: Sat, 26 Jan 2002 19:30:47 +0200
Adding to my last post, since I forgot it. There are other ways to
coerce man(1) into executing commands, but I don't know how paranoid
we want to get. For instance try this command:
$ PAGER="cat >/dev/null; echo T KERAMIDA DIE NOW K PLZ THX" man ls
T KERAMIDA DIE NOW K PLZ THX
Obviously the full power of a shell interpreter is a rather versatile
thing to have in the PAGER environment variable, but do we really want
this? I would suggest dropping everything after the first ';'
character but quoting and other stuff can make this fail too.
Any other ideas?
--
Giorgos Keramidas . . . . . . . . . keramida@{ceid.upatras.gr,freebsd.org}
FreeBSD Documentation Project . . . http://www.freebsd.org/docproj/
FreeBSD: The power to serve . . . . http://www.freebsd.org/
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200201261740.g0QHe2107512>