Le 26 janv. 2012 à 20:30, Jens Alfke a écrit : > > On Jan 26, 2012, at 10:22 AM, Andrew wrote: > >> NSString *cmd = [NSString stringWithFormat:@"cd \"%@\"; clear”, dir]; // >> Assumes bash, which is okay for me, but maybe not others. > > Watch out — that line has quoting problems. If the path to the directory > contains double-quotes, dollar signs, backslashes, exclamation points or > various other shell meta-characters, that command will at best fail and at > worst do something unexpected. There’s even a remote chance this could be > used as an exploit to run malicious code, depending on how that directory > path got created. For example, if someone could create a directory named > ";rm -rf ~;" > (including the quotes) it would be quite dangerous to use your code to open a > Terminal window on it or any subdirectory of it. Given that many document > formats are actually packaged directory trees, I can think of ways this could > be done without a user's knowledge... > > To work around this I suggest using single-quotes instead, and preprocessing > the string to insert a backslash in front of any exclamation point or > single-quote. I *think* that will be enough.
And before backslash too I think (what if the directory name is d\';rm -rf ~;\' ) -- Jean-Daniel _______________________________________________ Cocoa-dev mailing list (Cocoa-dev@lists.apple.com) Please do not post admin requests or moderator comments to the list. Contact the moderators at cocoa-dev-admins(at)lists.apple.com Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/cocoa-dev/archive%40mail-archive.com This email sent to arch...@mail-archive.com
