Skip to content

Improved safety atop.daily#379

Open
GermanAizek wants to merge 1 commit into
Atoptool:masterfrom
GermanAizek:patch-3
Open

Improved safety atop.daily#379
GermanAizek wants to merge 1 commit into
Atoptool:masterfrom
GermanAizek:patch-3

Conversation

@GermanAizek

Copy link
Copy Markdown
Contributor

Reasons create this PR changes

  • Substitution of variables without quotation marks
    In shell scripts, $PIDFILE and $LOGPATH are sometimes used without quotes, which is dangerous for paths with spaces or special characters

  • Executing external commands with substitution
    The use of ps -p 'cat $PIDFILE' and similar constructions (kill 'cat $PIDFILE') is dangerous if there is no verification of the contents of the PID file (for example, if the file is tampered with by an attacker)

  • Without checking the expandable path, it potentially allows you to delete files outside the destination area if variables are substituted

  • Before using the contents of the PIDFILE, make sure that it contains only numbers.

  • Instead of rm {} use -- and quoting

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant