It might be pointless to consider risks of passing result of qvm-run -p to dom0 Bash expansion when you have path traversal in the first place. When command «ls /etc/NetworkManager/system-connections/» in sys-net returns paths like “../.bashrc ../../.bashrc ../../../.bashrc” and the cat command returns some arbitrary shell commands, you are close to be totally compromised by a malicious sys-net.
Regards, Vít Šesták 'v6ak' -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/fb3d145c-770f-4123-92cd-b3deced1f3e2%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
