ControlxFreak / go2

Quickly navigate directories using a nickname configuration file!
MIT License
2 stars 2 forks source link

go2 and nickname need better input checking and character escaping #1

Open ControlxFreak opened 6 years ago

ControlxFreak commented 6 years ago

Both go2 and nickname's inputs need some improvements on their input checking / character escaping.

This is to prevent things like: nickname whatever -d /path/to/something;<malicious bash script> ^^ haven't tested but I think when go2 executed whatever, the command string would look like: cd /path/to/something;<malicious bash script> and would do something bad. Sort of like an SQL injection attack or something.

nickname mynickname -d /path/to/whatever -d /path/to/whatever

`nickname my-nickname` etc.
ControlxFreak commented 6 years ago

For "NICKNAME" variable, commit 8 now checks to see if the $1 variable is non-null.

Not closing this ptr. that was just 1 of many checks that need to be added.