Closed Bug 76109 Opened 25 years ago Closed 24 years ago

tinderbox system() calls, security

Categories

(Webtools Graveyard :: Tinderbox, defect)

Product:
Webtools Graveyard
Component:
Tinderbox
Type:
defect
Priority:
Not set
Severity:
blocker

Tracking

(Not tracked)

Status:
RESOLVED FIXED
Milestone:
Future

People

(Reporter: zach, Assigned: mcafee)

Details

It appears that tinderbox has a security hole. Several times, we use system() calls to call scripts with args, this is a Bad Thing (tm). We should use the argument form of system() or replace the .pl scripts with .pm's and call them with use. I talked to dmose on irc about this, and it appears real (though I wouldn't bet my life on it). Anyway, if it isn't, it doesn't really matter.
tinderbox client or server? Can you point out a specific example?
Target Milestone: --- → Future
i'd suspect server since the client isn't web interactive
switched to arg form of system call for all system() calls in the server that made sense. marking fixed.
Status: NEW → RESOLVED
Closed: 24 years ago
Resolution: --- → FIXED
Product: Webtools → Webtools Graveyard
You need to log in before you can comment on or make changes to this bug.