procmail
[Top] [All Lists]

Re: safely passing email to the shell

1999-03-30 00:55:06
This is not about Procmail really. I'm still Cc:ing the list. "Just
Hit Delete", as the spammers are wont to say.

On Mon, 29 Mar 1999 17:05:07 -0600 (CST), Mark Shaw
<mshaw(_at_)dal(_dot_)asp(_dot_)ti(_dot_)com> wrote:
system("/home/mshaw/bin/pager -number $number -text \"$text\"");
<...>
Well, obviously any special characters in $text are going to be
seen by the shell.  And that seems to have been my problem.  For-
tunately, when I wrote the pager script, I included a feature that
would take the text intended for transmission from a file rather

Or you could at least use single quotes, in which case only
single-quote characters in the messages would have to be quoted in
order to prevent the shell from seeing them. But you could do better;
there really isn't any reason to pass this to the shell at all.

system ("/home/mshaw/bin/pager", "-number", $number, "-text", $text);

The reason I think this is marginally relevant to the Procmail list is
that the whole SHELLMETAS issue is basically an instance of the same
phenomenon and that I wanted to point out that this is something the
generic you should probably understand about Unix.

/* era */

-- 
.obBotBait: It shouldn't even matter whether     <http://www.iki.fi/era/>
I am a resident of the state of Washington. <http://members.xoom.com/procmail/>
 * Sign the European spam petition! <http://www.politik-digital.de/spam/en/> *