Re: [Nmh-workers] proposed patch for shell metacharacter failure in nmh-1.7

[Ken Hornstein]

Everyone,

I'm wondering if this is the correct approach.

It seems kind of fragile to me to try quoting these characters, assuming
we are passing the entire line for mhshow entries to /bin/sh -c, since
we don't have any idea what that command line looks like (although ...
I don't think I really understand why Steven is using %{name}, but, I
guess it doesn't matter).  I really think to be safe we should simply
replace any shell metacharacters for those things, because I can imagine
some nasty security holes that we might encounter.

--Ken