You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I noticed that the way OSDelegatingFileTailingMessageProducer passing command string to Runtime.getRuntime().exec may cause problems if spaces (and other special characters) are used in the filename.
e.g foo bar -c 1 is a valid unix filename. The command would be interpreted as tail <options> /path/foo bar -c 1. This command tails two different files /path/foo and bar with option -c 1.
Just a caveat, command options could be injected because tail command on many linux distros accepts command options to be placed after file path.
I will make a PR for this issue soon.
The text was updated successfully, but these errors were encountered:
Fixes#3507
The `OSDelegatingFileTailingMessageProducer` passing command string to `Runtime.getRuntime().exec()`
may cause problems if spaces (and other special characters) are used in the filename.
* Use an array for command and its options to let the target `Runtime` to parse and
execute it properly
**Cherry-pick to 5.4.x, 5.3.x & 5.2.x**
Fixes#3507
The `OSDelegatingFileTailingMessageProducer` passing command string to `Runtime.getRuntime().exec()`
may cause problems if spaces (and other special characters) are used in the filename.
* Use an array for command and its options to let the target `Runtime` to parse and
execute it properly
**Cherry-pick to 5.4.x, 5.3.x & 5.2.x**
# Conflicts:
# spring-integration-file/src/main/java/org/springframework/integration/file/tail/OSDelegatingFileTailingMessageProducer.java
Fixes#3507
The `OSDelegatingFileTailingMessageProducer` passing command string to `Runtime.getRuntime().exec()`
may cause problems if spaces (and other special characters) are used in the filename.
* Use an array for command and its options to let the target `Runtime` to parse and
execute it properly
**Cherry-pick to 5.4.x, 5.3.x & 5.2.x**
# Conflicts:
# spring-integration-file/src/main/java/org/springframework/integration/file/tail/OSDelegatingFileTailingMessageProducer.java
I noticed that the way
OSDelegatingFileTailingMessageProducer
passing command string toRuntime.getRuntime().exec
may cause problems if spaces (and other special characters) are used in the filename.e.g
foo bar -c 1
is a valid unix filename. The command would be interpreted astail <options> /path/foo bar -c 1
. This commandtail
s two different files/path/foo
andbar
with option-c 1
.Just a caveat, command options could be injected because
tail
command on many linux distros accepts command options to be placed after file path.I will make a PR for this issue soon.
The text was updated successfully, but these errors were encountered: