Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add shell escaping #116

Merged
merged 2 commits into from Dec 31, 2021
Merged

Add shell escaping #116

merged 2 commits into from Dec 31, 2021

Conversation

Jongy
Copy link
Contributor

@Jongy Jongy commented Jul 24, 2021

  • Not implemented for the pgrep command in pgrep-mode - gonna trust the user on that :)
  • Not implemented for the version_cmd because it's not needed there (only numbers are encoded, not strings)
  • Not escaping symbol names in get_symbol_offset because they are constants throughout the project.

I tested it with a PHP binary I put in /tmp/php''$(echo > yyy). Works like a charm (and no yyy file created in cwd, but neither does in master).
Also tested with /tmp/php$(echo > abc), no abc file created in cwd.
On master - both don't work & abc is created.

Also dropped a small commit that fixes a missing s(n)printf overflow (like 3120b8d)

Closes: #81

@adsr
Copy link
Owner

adsr commented Oct 26, 2021

Thank you @Jongy. This is on my backlog to review.

@adsr
Copy link
Owner

adsr commented Dec 31, 2021

Going to close and re-open this PR to hopefully trigger the new GitHub Actions CI.

@adsr adsr closed this Dec 31, 2021
@adsr adsr reopened this Dec 31, 2021
@adsr adsr merged commit 4dd673c into adsr:master Dec 31, 2021
@Jongy Jongy deleted the shell-escape branch December 31, 2021 10:28
@Jongy
Copy link
Contributor Author

Jongy commented Dec 31, 2021

Thanks @adsr !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Shell escape params in addr_objdump.c
2 participants