Re: [Help-bash] How to test against shell code injection?

[adrelanos]

Pierre Gaston:
> On Mon, Jul 8, 2013 at 2:48 AM, adrelanos <address@hidden> wrote:
>> Hi,
>>
>> I wrote a server in bash. It handles potentially untrusted input.
>>
>> Do you know some code to test if its safe?
>>
>> I mean and tried something like
>>
>> $(x) \
>>   ' \
>> `x`
>>
>> And nothing strange happened. No code execution.
>>
>> Do you have better suggestions?
>>
>> Cheers,
>> adrelanos
>>
> 
> Just the usual suggestions: validate your input, quote your "$var",
> don't use eval.
> Take care if you use shell variables in the arguments of commands that
> can write to files, database etc...
> eg: sed "s/$var/foo/g" allows sed code injections, writing and reading
> arbitrary files (and running arbitrary commands if you use gnu sed)

Thanks. I keep that in mind. I was looking for such kind of safe coding
advice.