[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

Re: [PATCH] Quote filename passed to $EDITOR

From: Ulrich Drepper <drepper_at_redhat.com>
Date: 2002-07-23 19:48:19 CEST

On Tue, 2002-07-23 at 09:53, Karl Fogel wrote:

> (I suppose we could have a configuration-determined character that
> gets substituted in, but doesn't seem worth the trouble...)

I do think it is. This is a potential security hole.

And re not using something else but system. I haven't seen the
discussions but it seems to be again "a minimum functionality dictates
usage" thing. This is wrong. If you'd use posix_spawn() or even
fork()/exec you'd not only get better security but also significantly
more speed and and less resource usage (executing a shell is extrememly

---------------.                          ,-.   1325 Chesapeake Terrace
Ulrich Drepper  \    ,-------------------'   \  Sunnyvale, CA 94089 USA
Red Hat          `--' drepper at redhat.com   `------------------------

Received on Tue Jul 23 19:49:54 2002

This is an archived mail posted to the Subversion Dev mailing list.

This site is subject to the Apache Privacy Policy and the Apache Public Forum Archive Policy.