Opened 12 years ago
Last modified 2 years ago
#10680 closed Developer Task
MythSystem doesn't escape shell arguments — at Initial Version
| Reported by: | Owned by: | ||
|---|---|---|---|
| Priority: | minor | Milestone: | needs_triage |
| Component: | MythTV - MythSystem | Version: | Master Head |
| Severity: | medium | Keywords: | |
| Cc: | Ticket locked: | no |
Description
The MythSystem utility doesn't escape shell metacharacters in arguments. That means that if an argument has a space in it, the command will fail. Worse, if an argument has a pipe in it, then an external program will inadvertently be executed.
Everyone using MythSystem seems to be doing their own (broken) escaping. See, for example, 50f91450b3136cc5d0e832946d6b161ff640fcfb.
I tried to correct the broken escaping mechanisms I could find, (see https://github.com/MythTV/mythtv/pull/18). The request was denied, (see issue #10677), on the grounds that MythSystem should manage the escaping.
So it seems that MythSystem ought to escape shell arguments, at least in the case where the arguments are supplied as a QStringList. If that's not possible soon, then IMHO issue #10677 ought to be reopened. I filed this ticket so that either course would be possible.
