procmail
[Top] [All Lists]

Re: safely passing email to the shell

1999-03-30 05:35:45
On 30 March 1999, era eriksson <era(_at_)iki(_dot_)fi> wrote:
This is not about Procmail really. I'm still Cc:ing the list. "Just
Hit Delete", as the spammers are wont to say.

On Mon, 29 Mar 1999 17:05:07 -0600 (CST), Mark Shaw
<mshaw(_at_)dal(_dot_)asp(_dot_)ti(_dot_)com> wrote:
 > system("/home/mshaw/bin/pager -number $number -text \"$text\"");
<...>
 > Well, obviously any special characters in $text are going to be
 > seen by the shell.  And that seems to have been my problem.  For-
 > tunately, when I wrote the pager script, I included a feature that
 > would take the text intended for transmission from a file rather

Or you could at least use single quotes, in which case only
single-quote characters in the messages would have to be quoted in
order to prevent the shell from seeing them. But you could do better;
there really isn't any reason to pass this to the shell at all.

system ("/home/mshaw/bin/pager", "-number", $number, "-text", $text);

The reason I think this is marginally relevant to the Procmail list is
that the whole SHELLMETAS issue is basically an instance of the same
phenomenon and that I wanted to point out that this is something the
generic you should probably understand about Unix.

    Quoting from the Unix programming FAQ:

: The recipients of a message can simply be specified on the command
: line.  This has the drawback that mail addresses can contain
: characters that give `system()' and `popen()' considerable grief,
: such as single quotes, quoted strings etc. Passing these constructs
: successfully through shell interpretation presents pitfalls. (One can
: do it by replacing any single quotes by the sequence single-quote
: backslash single-quote single-quote, then surrounding the entire
: address with single quotes. Ugly, huh?)

    Regards,

    Liviu Daia

-- 
Dr. Liviu Daia               e-mail:   Liviu(_dot_)Daia(_at_)imar(_dot_)ro
Institute of Mathematics     web page: http://www.imar.ro/~daia
of the Romanian Academy      PGP key:  http://www.imar.ro/~daia/daia.asc