|
| From: | Ken Hornstein |
| Subject: | Re: [Nmh-workers] proposed patch for shell metacharacter failure in nmh-1.7 |
| Date: | Mon, 15 Jan 2018 11:11:55 -0500 |
>> I really think to be safe we should simply
>> replace any shell metacharacters for those things,
>
>I'm not sure that could be done completely safely. See below about not
>using /bin/sh -c.
Our official list of shell metacharacters in argsplit() is:
#define METACHARS "$&*(){}[]'\";\\|?<>~`\n"
It seems like replacing all of those for any MIME parameter we encounter
would make sense, and would be safe?
--Ken
| [Prev in Thread] | Current Thread | [Next in Thread] |