Re:Critical vulnerability of NPM package macaddress
by tomxor on Monday June 11, 2018 @11:02AM
(#17284807)
> In this particular case, you know the result has to be a subpath under /sys/class/net
I get that in _this_ case, but I'm talking more generally, sometimes parameters are allowed to or even need to have various other non alphanumeric chars, and then you start going down the fallible road of differentiation... trying to sanitise not quite everything without letting exploits pass through which is dangerous.
But in the more general case of "it's a parameter" can't we just quote it, sanitise for single quotes and then know it's safe?
I get that in _this_ case, but I'm talking more generally, sometimes parameters are allowed to or even need to have various other non alphanumeric chars, and then you start going down the fallible road of differentiation... trying to sanitise not quite everything without letting exploits pass through which is dangerous.
But in the more general case of "it's a parameter" can't we just quote it, sanitise for single quotes and then know it's safe?