On 2016/02/03 00:25, Dmitrij D. Czarkoff wrote: > Stuart Henderson said: > > On 2016/02/02 21:58, Landry Breuil wrote: > > > Oh, and the code in src/int/file_magic.c even has a fallback to use file > > > %s -b --mime-type called via popen().. > > > > It would be nice to kill the other options and use file(1) from base > > as the only detection method, it is *loads* safer. > > Well, the actual code is: > > | snprintf(command, sizeof(command), "file \"%s\" -b --mime-type", filename); > > Note double quotes. Of course no quoting is performed on filename. > Thus: > > 1. If filename contains double quote, vifm sigfaults. > 2. If filename is nasty, nasty things happen. Eg. I renamed a png image > to "$(echo text)", and vifm opened it in vi. I guess filename > "`doas rm -Rf $HOME/*`" will also pleasantly surprise user.
Ugh. I have seen CVEs assigned for smaller problems than that!