QutEcoacoustics / baw-server

The acoustic workbench server for storing and managing ecoacoustic data. Manages the structure and audio data. Provides an API for clients access.
Apache License 2.0
9 stars 4 forks source link

Use single quotes for paths (backtick substitution possible) #674

Open atruskie opened 7 months ago

atruskie commented 7 months ago

A malicious path that contains characters that allow for command execution - such a backtick, or dollar operator - could in theory allow for command execution.

This is not possible currently since we never execute our audio tools on user supplied path.

If we use single quotes to wrap paths for our exec code then we can be sure this is never a risk. We currently use double quotes.

We should also test this.