in reply to Re: UGU file rename script (GOLF?)
in thread UGU file rename script (GOLF?)
`rm -rf /` in an eval would execute rm with the user's own permissions. If the user can run rename '`rm -rf /`' on the command line, they could just as easily run rm -rf / directly.
In other words, as long as you don't do something foolish like make the rename script setuid or create a web interface to it, I would argue that this script has no inherent security issues.
|
---|
Replies are listed 'Best First'. | |
---|---|
Re: Re: Re: UGU file rename script (GOLF?)
by myocom (Deacon) on Jul 20, 2001 at 01:49 UTC |
In Section
Meditations