[ 
https://issues.apache.org/jira/browse/MESOS-6235?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Jie Yu updated MESOS-6235:
--------------------------
    Fix Version/s: 1.1.0

> Add 'argv' variant of 'os::system'
> ----------------------------------
>
>                 Key: MESOS-6235
>                 URL: https://issues.apache.org/jira/browse/MESOS-6235
>             Project: Mesos
>          Issue Type: Task
>            Reporter: Kevin Klues
>            Assignee: Kevin Klues
>             Fix For: 1.1.0, 1.0.2
>
>
> The {{os::system()}} function always spawns whatever string you pass to is a 
> a direct argument to {{sh -c '<arg_string>'}}. However, this can be 
> problematic if you build {{<arg_string>}} from user supplied input and they 
> have the opportunity to inject arbitrary commands at the end of it (e.g. by 
> adding a "; rm -rf" as part of the last user supplied argument).
> To counter this, we should introduce a variant of {{os::system()}} that takes 
> a single command and a list of args (similar to the {{posix_spawn()}} 
> function.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Reply via email to