Timeline for Are these bash lines (handling untrusted user input) vulnerable to command injection?
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 19 at 7:30 | comment | added | Esa Jokinen | @ikkachu Thanks! I've updated my answer. | |
| Nov 19 at 7:30 | history | edited | Esa Jokinen | CC BY-SA 4.0 |
update code based on a comment
|
| Nov 18 at 19:52 | comment | added | ilkkachu |
not like that you can't remove anything, as that leaves the shell looking for the end of the backquote-command substitution. You'll need to escape the backquote too (and you might as well escape the dollar sign too while you're at it). sanitized="${1//[\$`\\]/}" seems to work in Bash 5.1, Bash 3.2 and zsh, at least.
|
|
| Nov 18 at 5:03 | comment | added | Esa Jokinen |
Thanks @dave_thompson_085! I was trying to explain why the two examples might have seemed unsafe if $(command) was passed unquoted (without 's), but your explanation is more clear.
|
|
| Nov 17 at 22:54 | comment | added | dave_thompson_085 |
Your first point is good, but ./script '$(command)' passes the actual construct not the output to the script (and is well within the sorts of things attackers would do)
|
|
| Nov 17 at 13:57 | history | answered | Esa Jokinen | CC BY-SA 4.0 |