Re: [akr@M17N.ORG: cvs security problem]

[Larry Jones]

Ian Lance Taylor writes:
> 
> As I read the code, Update.prog lets me have an arbitrary number of
> arguments.  Look at run_setup.  Given that much leeway, I could do a
> lot using /bin/sh -c.

You're right, you can have arguments.  I don't think sh -c would be very
useful, though, since only the immediately following argument is
interpreted as a command and there's no provisions in run_setup for
quoting whitespace.

-Larry Jones

I sure like summer vacation. -- Calvin