Skip to content

genserv.pl: make external calls safe#20971

Closed
vszakats wants to merge 7 commits intocurl:masterfrom
vszakats:certscript-no-redir
Closed

genserv.pl: make external calls safe#20971
vszakats wants to merge 7 commits intocurl:masterfrom
vszakats:certscript-no-redir

Conversation

@vszakats
Copy link
Copy Markdown
Member

@vszakats vszakats commented Mar 18, 2026

By passing command-line as separate arguments instead of using a single
string. This needs skipping the shell, so rework redirections to use
Perl open3().

Also explored to use -out to avoid redirections, but it makes the
command-line incompatible with some OpenSSL implementations/versions
(e.g. on default macOS), and would still need a solution for
2>/dev/null.

Ref: https://perldoc.perl.org/IPC::Open3


  • make the 5 calls continue to redirect stderr to /dev/null

@vszakats vszakats marked this pull request as draft March 18, 2026 01:40
@vszakats vszakats force-pushed the certscript-no-redir branch from 52c4c53 to 97f4eaf Compare March 23, 2026 10:04
@vszakats vszakats changed the title genserv.pl: try securing external calls genserv.pl: make external calls safe Mar 23, 2026
@vszakats vszakats marked this pull request as ready for review March 23, 2026 10:13
@vszakats vszakats closed this in 806fd7a Mar 23, 2026
@vszakats vszakats deleted the certscript-no-redir branch March 23, 2026 11:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Development

Successfully merging this pull request may close these issues.

1 participant