Richard W.M. Jones wrote: > Richard W.M. Jones wrote: > >+ strcat(cmd, newdisk->src); > > Also, is quoting/escaping required? In a naive libvirt-based app, it's > plausible that the string is provided by the user and could contain \n > to send arbitrary commands to the qemu console.
Agreed. We can use something like qemudEscapeShellArg for that. This (untested) patch adds qemudEscapeArg for non-shell arguments. -jim -- Libvir-list mailing list [email protected] https://www.redhat.com/mailman/listinfo/libvir-list
