What, if any, safety considerations are there in going with the simple backtick solution?
Are we afraid of a Trojanned date program?
What other security risks might we encounter here?
--
Microsoft delendum est. | [reply] |
The biggest security concern with print `date` is not that system's date binary has been trojaned. If that were the case, you're already screwed. I'd be more concerned that combined with some sort of path munging, an entirely different file named date could be executed. If it used an absolute path name, I dont think there would be much of a security concern at all. i.e. print `/bin/date` would be a step in the right direction.
From a coding standpoint, shelling out trivial things like this is a performance hit, and I'd flag it in any program that wasn't a throwaway. Of course, virtualsue, only advocated it for use in quick 'n dirty stuff anyway.
-Blake
| [reply]
[d/l]
[select] |