Re: [PLUG] unix cp function call (thanks)

[gabriel rosenkoetter <gr@eclipsed.net>]

On Sun, Jun 16, 2002 at 12:12:51PM -0400, Walt Mankowski wrote:
> system(3) only takes one parameter -- a pointer to a character array.
> What's the problem?

That, no matter what's in that char string, you can't trust the
environment under which the application was started (see the
previous discussion of chroot(8), LD_LIBRARY_PATH, PATH, and a
myriad of other complications), so you can't just blindly execute a
path a user gives you. system(3) is a temporary hack if it's using
user-supplied data and a security problem even if it's your own data
(for mostly the same reasons).

-- 
gabriel rosenkoetter
gr@eclipsed.net

Attachment: pgpQ1xYQaqdzC.pgp
Description: PGP signature