From: Seebs <usenet-nospam@...>
Date: 2010-02-09T12:25:11+09:00
Subject: Re: Looking for external program invocations

On 2010-02-09, Mark Hobley <markhobley@hotpop.donottypethisbit.com> wrote:
> I am thinking that I can use grep to locate the code lines, and then reverse
> engineer the code section, to find out where the command data comes from, and
> whether or not it is from a secure source.

Maybe.

> A quick google tells me that I need to look for backticks or a system command.

Or %x.

> Can commands avoid grep by being split using a line break?

Perhaps?

> Can macros be derived from strings and then subsequently used as a command
> by using only the macro name?

Something like that is certainly conceivable.

Okay, here's your problem:  Imagine that there's some underlying dangerous
call:

	foo("bar")

And you want to hide this.  Okay.  How about...

	x = 'b'
	x << a
	x << r
	y = 'f'
	y << 'o'
	y << y[1]
	y << '('
	y << 'x'
	y << ')'
	eval y

In short, the question is whether you are worried about intentional deception,
or just about carelessness.  For carelessness, you probably don't need to
worry about split lines and so on, and a quick scan through the project for
places where commands might be run may do it.

-s
-- 
Copyright 2010, all wrongs reversed.  Peter Seebach / usenet-nospam@seebs.net
http://www.seebs.net/log/ <-- lawsuits, religion, and funny pictures
http://en.wikipedia.org/wiki/Fair_Game_(Scientology) <-- get educated!