>This is true, and to be more sure, the first param should be
>/usr/bin/osascript . And even that's [not] 100% as the user may have moved it.
If users move files installed by Apple in standard locations, then they
only have themselves to blame when things go wrong.
"More sure" is always a tradeoff. Yes, providing an absolute pathname is
"more sure" in one sense: it doesn't use the PATH env-var. No, it isn't
normally necessary, nor is it less exploitable. It depends on what the
software is doing.
The few cases where I might consider it relevant are all related to
security, which is about removing exploitable assumptions, but also about
handling the consequences when something unexpected happens. There are
already plenty of assumptions intrinsic to running an external script, so
the extra sureness one might gain from an absolute pathname hardly seems
worthwhile. Heck, the user could have mounted a file-system on /usr or
/usr/bin, too, so even "sure" assumptions about pathnames can be negated by
a clever enough attack.
-- GG
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Java-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/java-dev/email@hidden
This email sent to email@hidden
