Re:Critical vulnerability of NPM package macaddress
by tomxor on Monday June 11, 2018 @11:22AM
(#17285006)
> Escaping and quoting is the wrong way to go. Even if it works you're technically not totally correct as you can't reference my network interface named "bad'name"[1]. If you can avoid fork/exec you're always better off. In this case reading the file directly is fine. I can't think of a valid reason to fork and invoke cat.
Yes I get that, I should have clarified: in the general use of exec (i.e a valid and necessary use).
> If you have a legit reason to fork and run then use execFile(...)
You are absolutely right, execFile is a much better way, I've used it before and I guess you are right - in _most_ cases this should be the #1 choice.
[edited] - irrelevant details of obscure case where execFile isn't enough.
Anyway, in a case where exec through a shell is necessary for some reason, i'm wondering if this method of single quoting is actually safe or not, as far as I can see it is, but i'm not a security expert.
Yes I get that, I should have clarified: in the general use of exec (i.e a valid and necessary use).
> If you have a legit reason to fork and run then use execFile(...)
You are absolutely right, execFile is a much better way, I've used it before and I guess you are right - in _most_ cases this should be the #1 choice.
[edited] - irrelevant details of obscure case where execFile isn't enough.
Anyway, in a case where exec through a shell is necessary for some reason, i'm wondering if this method of single quoting is actually safe or not, as far as I can see it is, but i'm not a security expert.