ssh-host-config eval password bug

Ian Kelling smallnow@gmail.com
Sun Jul 5 22:49:00 GMT 2009


Eric Blake wrote:
> The eval is still reasonable, but with proper quoting:
>> if eval cygrunsrv ... -y tcpip "${cygwin_env}"

No, thats not true. It is impossible to safely eval arbitrary user input.
Your simple quote doesn't help much:
# x="ok;ls"
# eval echo "{$x}"
For more in depth information, read this:
http://mywiki.wooledge.org/BashFAQ/048
- Ian Kelling
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple


More information about the Cygwin mailing list

AltStyle によって変換されたページ (->オリジナル) /