search

haampie / libtree

ldd as a tree
MIT License
2.67k stars 60 forks source link

Properly execute tools (like `chrpath`) witth `execve`instead of `system` #41

Open cipriancraciun opened 2 years ago

cipriancraciun commented 2 years ago

At the moment, when invoking chrpath or strip, the tool seems to be using popen, which underneath just calls system with a command as a string.

chrpath_cmd << chrpath_path << " -c -r \"" << rpath << "\" " << deploy_path;

Unfortunately that command is not properly escapend, since if a library happens to include a quote, it basically allows "shell injection".

Moreover the deploy_path doesn't seem to be quoted at all.

(Granted, it is very unlikely that a library contains "strange" characters, like say libunsafe"; rm -Rf .;.so, however a tool should be safe regardless.)

haampie commented 2 years ago

Yeah, this is how it's supposed to go. If someone doesn't already pick this up, I'll try to get to it soon.