[mythtv-commits] Ticket #10680: MythSystem doesn't escape shell arguments

MythTV noreply at mythtv.org
Wed May 2 04:56:12 UTC 2012


#10680: MythSystem doesn't escape shell arguments
-------------------------+--------------------------------------
 Reporter:  github@…     |           Type:  Bug Report - General
   Status:  new          |       Priority:  minor
Milestone:  unknown      |      Component:  MythTV - General
  Version:  Master Head  |       Severity:  medium
 Keywords:               |  Ticket locked:  0
-------------------------+--------------------------------------
 The !MythSystem utility doesn't escape shell metacharacters in arguments.
 That means that if an argument has a space in it, the command will fail.
 Worse, if an argument has a pipe in it, then an external program will
 inadvertently be executed.

 Everyone using !MythSystem seems to be doing their own (broken) escaping.
 See, for example, 50f91450b3136cc5d0e832946d6b161ff640fcfb.

 I tried to correct the broken escaping mechanisms I could find, (see
 https://github.com/MythTV/mythtv/pull/18). The request was denied, (see
 issue #10677), on the grounds that !MythSystem should manage the escaping.

 So it seems that !MythSystem ought to escape shell arguments, at least in
 the case where the arguments are supplied as a QStringList. If that's not
 possible soon, then IMHO issue #10677 ought to be reopened. I filed this
 ticket so that either course would be possible.

-- 
Ticket URL: <http://code.mythtv.org/trac/ticket/10680>
MythTV <http://code.mythtv.org/trac>
MythTV Media Center


More information about the mythtv-commits mailing list