Nathan Ingersoll wrote:
On 12/22/05, Daniele Venzano <[EMAIL PROTECTED]> wrote:
snprintf(cmd, sizeof(cmd), "edje_cc -v %s %s %s \"%s\"",
Also all strings passed to the system() call should be audited for the
same problem in e_utils/src/bin/e17setroot/e17setroot.c
If this is a point where commands could be injected, then those quotes are
not sufficient to guard against any real attack. The contents pushed into
that final %s could contain their own set of quotes such as: "; rm -rf
$HOME; echo "h4x0red!
I don't think code injection was the concern here..
and the last %s would be either the edc created by e17setroot, or the
target edj, I think...
Cheers,
--
Morten
:wq
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
enlightenment-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/enlightenment-devel
