On Jan 26, 2012, at 10:22 AM, Andrew wrote:
> NSString *cmd = [NSString stringWithFormat:@"cd \"%@\"; clear”, dir]; //
> Assumes bash, which is okay for me, but maybe not others.
Watch out — that line has quoting problems. If the path to the directory
contains double-quotes, dollar signs, backslashes, exclamation points or
various other shell meta-characters, that command will at best fail and at
worst do something unexpected. There’s even a remote chance this could be used
as an exploit to run malicious code, depending on how that directory path got
created. For example, if someone could create a directory named
";rm -rf ~;"
(including the quotes) it would be quite dangerous to use your code to open a
Terminal window on it or any subdirectory of it. Given that many document
formats are actually packaged directory trees, I can think of ways this could
be done without a user's knowledge...
To work around this I suggest using single-quotes instead, and preprocessing
the string to insert a backslash in front of any exclamation point or
single-quote. I *think* that will be enough.
—Jens
_______________________________________________
Cocoa-dev mailing list ([email protected])
Please do not post admin requests or moderator comments to the list.
Contact the moderators at cocoa-dev-admins(at)lists.apple.com
Help/Unsubscribe/Update your Subscription:
https://lists.apple.com/mailman/options/cocoa-dev/archive%40mail-archive.com
This email sent to [email protected]
