Re: Open a new terminal tab or window from a Cocoa app at a certain directory without using NSAppleScript?
Re: Open a new terminal tab or window from a Cocoa app at a certain directory without using NSAppleScript?
- Subject: Re: Open a new terminal tab or window from a Cocoa app at a certain directory without using NSAppleScript?
- From: Jean-Daniel Dupas <email@hidden>
- Date: Thu, 26 Jan 2012 23:28:21 +0100
Le 26 janv. 2012 à 20:30, Jens Alfke a écrit :
>
> On Jan 26, 2012, at 10:22 AM, Andrew wrote:
>
>> NSString *cmd = [NSString stringWithFormat:@"cd \"%@\"; clear”, dir]; // Assumes bash, which is okay for me, but maybe not others.
>
> Watch out — that line has quoting problems. If the path to the directory contains double-quotes, dollar signs, backslashes, exclamation points or various other shell meta-characters, that command will at best fail and at worst do something unexpected. There’s even a remote chance this could be used as an exploit to run malicious code, depending on how that directory path got created. For example, if someone could create a directory named
> ";rm -rf ~;"
> (including the quotes) it would be quite dangerous to use your code to open a Terminal window on it or any subdirectory of it. Given that many document formats are actually packaged directory trees, I can think of ways this could be done without a user's knowledge...
>
> To work around this I suggest using single-quotes instead, and preprocessing the string to insert a backslash in front of any exclamation point or single-quote. I *think* that will be enough.
And before backslash too I think (what if the directory name is d\';rm -rf ~;\' )
-- Jean-Daniel
_______________________________________________
Cocoa-dev mailing list (email@hidden)
Please do not post admin requests or moderator comments to the list.
Contact the moderators at cocoa-dev-admins(at)lists.apple.com
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden