linux-application-whitelisting / fapolicyd

File Access Policy Daemon
GNU General Public License v3.0
192 stars 55 forks source link

Add shell escaping for syslog output #226

Closed radosroka closed 1 year ago

radosroka commented 1 year ago
stevegrubb commented 1 year ago

In escape_shell(), what is expected_size used for? What is the longest length input might be? buffer needs to be at least 4 times it's size. Buffer also might be better off on the heap, meaning a static char [] just above the function for machines with limited stack space.

In format_value(), maybe

if (need_escape)
    out = escape_shell(str, ...
else
   if (asprintf(&out, ...
        out = NULL;

to avoid calling free at all. Also, static analyzers may not be able to reason about whether it needs freeing when "?" is assigned.

radosroka commented 1 year ago

@stevegrubb you can check it now it's little bit cleaner.

stevegrubb commented 1 year ago

OK, looks good.