<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On 16 Sep 2009, at 20:17, Hiren Patel wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Ton Voon wrote:<br><blockquote type="cite">Andreas' suggestion about checking for shell characters and using an execv method for non-shell commands is captured here: <a href="http://tracker.nagios.org/view.php?id=86">http://tracker.nagios.org/view.php?id=86</a><br></blockquote><br>please see if the attached diffs are acceptable for the function checking for meta characters, I may pick this up to work on as I find it interesting.<br><br><font class="Apple-style-span" color="#006312"><br></font>--- nagios.h<span class="Apple-tab-span" style="white-space:pre"> </span>2008-12-14 16:52:23.000000000 +0200<br>+++ /tmp/nagios.h<span class="Apple-tab-span" style="white-space:pre"> </span>2009-09-16 21:10:18.000000000 +0200<br>@@ -807,6 +807,7 @@<br><br> char *get_program_version(void);<br> char *get_program_modification_date(void);<br>+int has_shell_metachars(const char *);<br><br> mmapfile *mmap_fopen(char *);<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>/* open a file read-only via mmap() */<br> int mmap_fclose(mmapfile *);<br>--- utils.c<span class="Apple-tab-span" style="white-space:pre"> </span>2009-08-11 19:29:52.000000000 +0200<br>+++ /tmp/utils.c<span class="Apple-tab-span" style="white-space:pre"> </span>2009-09-16 21:06:05.000000000 +0200<br>@@ -4589,7 +4589,12 @@<br> <span class="Apple-tab-span" style="white-space:pre"> </span>return (char *)PROGRAM_MODIFICATION_DATE;<br> }<br><br>-<br>+int has_shell_metachars(const char *s){<br>+<span class="Apple-tab-span" style="white-space:pre"> </span>if (strpbrk(s,"!$^&*()~[]\\|{};<>? \t"))<br>+<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>return 1;<br>+<span class="Apple-tab-span" style="white-space:pre"> </span>else<br>+<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>return 0;<br>+}<br><br> /******************************************************************/<br> /*********************** CLEANUP FUNCTIONS ************************/<br></blockquote></div><br><div>Hi Hiren,</div><div><br></div><div>Looks okay, but single quote looks missing. Can you add some tap tests? Some example commands, and whether has_shell_metachars returns the expected value would be great.</div><div><br></div><div><a href="http://wiki.nagios.org/index.php/Nagios_Core_Developer_Guidelines#Testing">http://wiki.nagios.org/index.php/Nagios_Core_Developer_Guidelines#Testing</a></div><div><br></div><div>You'll need to do some tests in t-tap. Might be tricky to setup because there's nothing yet for testing utils.c</div><div><br></div><div>Ton</div><div><br></div></body></html>