Skip to content

Conversation

greenius
Copy link

@greenius greenius commented Nov 26, 2024

Do not call quotemeta on cmdv4 and cmdv6 arguments as it prevents executing commands with arguments. eg. it is now possible to get an IP address with:

usev4=cmdv4
cmdv4="dig +short myip.opendns.com @resolver1.opendns.com"

Fixes #736

@indrajitr
Copy link
Contributor

This might include cases that require more testing.
For example, scenarios like cmdv4="my\ alt\ path/bin/helper detect_ip"

Copy link
Member

@rhansen rhansen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@greenius I rebased your commit onto latest main and pushed a fixup to refine your commit's message and eliminate an unnecessary variable. Would you mind reviewing it and letting me know if it looks OK to you? If so, I'll autosquash the two commits and merge.

@rhansen rhansen mentioned this pull request Jan 9, 2025
@greenius
Copy link
Author

greenius commented Jan 9, 2025

Amendment looks good to me.

steven and others added 3 commits January 9, 2025 19:29
`quotemeta` prevents executing commands with arguments.  With this
change, it is now possible to get an IP address with:

    usev4=cmdv4
    cmdv4="dig +short myip.opendns.com @resolver1.opendns.com"
@rhansen rhansen merged commit 6bb80cb into ddclient:main Jan 10, 2025
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

cmdv4-args and cmdv6-args options
3 participants