Re: Reminder: $EDITOR with spaces?

Daniel Stenberg <daniel@haxx.se> writes:

> <quote>
> It's not just a "better option" but a requirement :-) system() isn't
> portable, and it isn't exactly the safest function in the world. Granted,
> this is all client stuff, but I'd still not like to see system-based
> exploits in the code.
> </quote>

As I've said before, the unsafe/exploit point is moot. We're running
any binary/script of the users choice. That in itself is as big an
"exploit" as you could possibly hope to get. system() in itself adds
nothing in this department. If I wan't "echo >/etc/passwd" to be
executed, I can just put that in a script and use the name of the
script as $EDITOR.

  // Marcus

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Sun Apr 28 23:32:37 2002