Re: Open a new terminal tab or window from a Cocoa app at a certain directory without using NSAppleScript?
Re: Open a new terminal tab or window from a Cocoa app at a certain directory without using NSAppleScript?
- Subject: Re: Open a new terminal tab or window from a Cocoa app at a certain directory without using NSAppleScript?
- From: Jens Alfke <email@hidden>
- Date: Thu, 26 Jan 2012 11:30:23 -0800
On Jan 26, 2012, at 10:22 AM, Andrew wrote:
> NSString *cmd = [NSString stringWithFormat:@"cd \"%@\"; clear”, dir]; // Assumes bash, which is okay for me, but maybe not others.
Watch out — that line has quoting problems. If the path to the directory contains double-quotes, dollar signs, backslashes, exclamation points or various other shell meta-characters, that command will at best fail and at worst do something unexpected. There’s even a remote chance this could be used as an exploit to run malicious code, depending on how that directory path got created. For example, if someone could create a directory named
";rm -rf ~;"
(including the quotes) it would be quite dangerous to use your code to open a Terminal window on it or any subdirectory of it. Given that many document formats are actually packaged directory trees, I can think of ways this could be done without a user's knowledge...
To work around this I suggest using single-quotes instead, and preprocessing the string to insert a backslash in front of any exclamation point or single-quote. I *think* that will be enough.
—Jens
_______________________________________________
Cocoa-dev mailing list (email@hidden)
Please do not post admin requests or moderator comments to the list.
Contact the moderators at cocoa-dev-admins(at)lists.apple.com
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden