<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<font size="3">I agree with you, unix() call into .sci macros (of
scilab distrib.) has to be prohibited.<br>
<br>
Pierre<br>
<br>
<br>
</font><br>
Sylvestre Ledru a écrit :
<blockquote cite="mid:1202462188.24488.177.camel@korcula.inria.fr"
type="cite">
<pre wrap="">Hi,
I am thinking about changing the behaviour of the function ls
<a class="moz-txt-link-freetext" href="http://www.scilab.org/product/man/index.php?module=fileio&page=ls.htm">http://www.scilab.org/product/man/index.php?module=fileio&page=ls.htm</a>
I would like to remove the second input argument for a few reasons:
* security issues. This simple example shows how weak it is :
ls("*.sci","`echo hacked >/tmp/hmhm`")
* Compatiblity and portability. A user working under Linux and using
tricks on this function won't have the same result under proprietary
operating systems.
* We are too closely related to the ls behaviour on the platform
* The code could be directly pluged to the listfiles and therefore
facilitate the maintenance (It is already the case under Windows).
Any objections ?
Sylvestre
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="80">--
===================================================
Pierre MARECHAL
INRIA - Centre de Recherche de Paris - Rocquencourt
Domaine de Voluceau - B.P. 105
78153 Le Chesnay Cedex
===================================================
Equipe-Projet Scilab
Bâtiment 1B - Bureau 008
Email : <a class="moz-txt-link-abbreviated" href="mailto:pierre.marechal@inria.fr">pierre.marechal@inria.fr</a>
===================================================</pre>
</body>
</html>