Charles Duffy opened MSHARED-297 and commented
The Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
The BourneShell class should unconditionally single-quote emitted strings (including the name of the command itself being quoted), with '"'"' used for embedded single quotes, for maximum safety across shells implementing a superset of POSIX quoting rules.
An appropriate fix has been built and applied against PLXUTILS; that patch is submitted here in the hope that it will be useful, though it is not expected to apply to the maven-shared-utils codebase without modification.
See PLXUTILS-161 for history/discussion.
Attachments:
Issue Links:
- MSHARED-431 1. (Hash-Sign) should trigger quoting in BourneShell.java
Remote Links:
Charles Duffy opened MSHARED-297 and commented
The Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
The BourneShell class should unconditionally single-quote emitted strings (including the name of the command itself being quoted), with
'"'"'used for embedded single quotes, for maximum safety across shells implementing a superset of POSIX quoting rules.An appropriate fix has been built and applied against PLXUTILS; that patch is submitted here in the hope that it will be useful, though it is not expected to apply to the maven-shared-utils codebase without modification.
See PLXUTILS-161 for history/discussion.
Attachments:
Issue Links:
Remote Links: