search

paddykontschak / irssi-notifier

Simple script for irssi to trigger Mac OS X 10.8's Notification Center
110 stars 13 forks source link

Vulnerable to arbitrary command execution #10

Open cdown opened 9 years ago

cdown commented 9 years ago

Hi,

Just to let you know, your use of system() is vulnerable to arbitrary command execution (this situation is especially bad since it can be invoked by anyone over IRC). Filtering characters is not enough. Don't use system(), use a real subprocess spawner that doesn't involve using a shell.

cdown commented 9 years ago

Specifically, because $title is not sanitised and $topic can be arbitrary.

Someguy123 commented 8 years ago

I was just about to install this script until I saw this issue. Thank's for posting this. This issue is terrifying and really needs to be fixed.

ghost commented 7 years ago

I just remembered I wrote this awhile back, ended up throwing generic libnotify support for a friend as well since I pretty much don't use macOS anymore.

I use fork() exec() so it shouldn't be vulnerable to this same problem as I'm not executing a shell. It should also be a hell of a lot faster, If you get bombarded with like 20 messages at once, since it does fork(); useful if you use a BNC.

https://github.com/GeneralUnRest/irssi-mac-notify