search

tsoding / porth

It's like Forth but in Python
628 stars 50 forks source link

run `porthy.py com -r` can be dangerous if the user do not send the correct `file_path` #47

Closed drocha87 closed 2 years ago

drocha87 commented 2 years ago

To reproduce this bug imagine the following scenario:

$ cat test.porth
34 35 + print
$ ./porth.py com -r test.py
$

As you can see the expected output should be 69 but it won't print anything. This happens because basedir is empty and basepath is ["test"] so exit(cmd_call_echoed([basepath] + argv, silent)) will run the command "test" which is a valid command in $PATH.