Re: [PATCH] Quote filename passed to $EDITOR

On Tue, 2002-07-23 at 09:53, Karl Fogel wrote:

> (I suppose we could have a configuration-determined character that
> gets substituted in, but doesn't seem worth the trouble...)

I do think it is. This is a potential security hole.

And re not using something else but system. I haven't seen the
discussions but it seems to be again "a minimum functionality dictates
usage" thing. This is wrong. If you'd use posix_spawn() or even
fork()/exec you'd not only get better security but also significantly
more speed and and less resource usage (executing a shell is extrememly
demanding).

-- 
---------------.                          ,-.   1325 Chesapeake Terrace
Ulrich Drepper  \    ,-------------------'   \  Sunnyvale, CA 94089 USA
Red Hat          `--' drepper at redhat.com   `------------------------