From: Petr Janda <petr@...>
Date: 2007-01-25T07:33:35+09:00
Subject: Re: Help with kernel.exec

Joel VanderWerf wrote:
> Petr Janda wrote:
>> Hey there,
>> Im trying to figure out something. If I had Postfix execute a ruby
>> script that says
>> 
>> Kernel.exec "/usr/sbin/sendmail -i -f #{@sender} -- #{@recipient}"
>> 
>> would this be a huge security risk? to me it seems so because if you had
>> a specially crafted email address you could execute a different command.
>> How to protect against it?
> 
> One thing you can do is to use 2 or more args with exec.
> 
> $ ri exec | cat
> ------------------------------------------------------------ Kernel#exec
>       exec(command [, arg, ...])
> ------------------------------------------------------------------------
>       Replaces the current process by running the given external
>       command. If exec is given a single argument, that argument is
>       taken as a line that is subject to shell expansion before being
>       executed. If multiple arguments are given, the second and
>       subsequent arguments are passed as parameters to command with no
>       shell expansion.
> ...

I did use it, but for some reason it kept being a pain in the arse.


Anyway, thanks to all! I installed tmail and ive modified the script and 
testing it now.

Petr

-- 
Posted via http://www.ruby-forum.com/.