bugGNU Octave - Bugs: bug #45398, system without shell

 
 

bug #45398: system without shell

Submitter:  CarnĂ« Draug <carandraug>
Submitted:  Wed 24 Jun 2015 07:41:08 PM UTC
   
 
Category:  Octave Function Severity:  1 - Wish
Priority:  5 - Normal Item Group:  Feature Request
Status:  None Assigned to:  None
Originator Name:  Open/Closed:  * Open
Release:  * dev Operating System:  * Any
Fixed Release:  None Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 24 Jun 2015 07:41:08 PM UTC, original submission:  

Other than fork and exec, it is not possible to make a system while avoiding the shell. Would be nice to have this, similar to perl's system:


@args = ("command", "arg1", "arg2");
system (@args);


and python's subprocess:


subprocess.call (["command", "arg1", "arg2"]);


The reason to avoid the shell is security. From python's own documentation


>>> from subprocess import call
>>> filename = input("What file would you like to display?\n")
What file would you like to display?
non_existent; rm -rf / #
>>> call("cat " + filename, shell=True) # Uh-oh. This will end badly...


We already have a bunch of extra options for system() so I'm proposing to implement something like perl, and skip the shell if the first argument is a cell array of strings. Does that sound good?

Carnë Draug <carandraug>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by carandraug (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code