SearchFAQMemberlist Log in
Reply to topic Page 1 of 1
"bug" (and fix for it) in rsna
Author Message
Post "bug" (and fix for it) in rsna 
On 6/18/07, David Cantrell <david < at > cantrell.org.uk ([email]david < at > cantrell.org.uk[/email])> wrote: On Sun, May 27, 2007 at 01:05:16PM +1000, Michael Ashley wrote:

backup root < at > mymachine.edu:/ mymachine/ rsync_long_args=-f "- *.fits?"
-f "- *.FITS?" -f "- *.bz2" -f "- *.gz" --max-size=64M
So the bug is still there. Slightly differently. The error is now:

Unknown filter rule: `"- *.fits?"'
rsync error: syntax or usage error (code 1) at exclude.c(759)

It goes away with my "join" fix.

Passing a scalar to system() makes my paranoid security senses go
"ping!" because it means that the command is handed to the shell for
argument parsing. Normally you don't want to do that because someone
could "poison" the command so that it (eg) ended with ';rm -rf /'. I'm
pretty sure we're safe in this case though, mostly because *everything*
that's getting passed to system() is coming from the rsnapshot.conf
file, which you do all of course keep nice n secure. Don't you.

I'll apply this fix unless anyone screams horribly.

It's my understanding that system() will escape the arguments to the shell, unlike using backticks.





--
Anthony Ettinger
Ph: 408-656-2473
var (bonita, farley) = new Dog;
farley.barks("very loud");
bonita.barks("at strangers");

http://chovy.dyndns.org/resume.html
http://utuxia.com/consulting

Post "bug" (and fix for it) in rsna 
On Tue, Jun 19, 2007 at 05:04:48PM -0700, Anthony Ettinger wrote:

If args are passed as a list, then it shouldn't be a problem.

But the whole point of this little thread is join()ing the args into a
scalar before passing them to system()!

We can't just join() the various space-seperated bits of a small part of
the list, because then that joined up bit gets passed as a single
argument to rsync which will get confused.

--
David Cantrell | Enforcer, South London Linguistic Massive

I remember when computers were frustrating because they did
exactly what you told them to. That seems kinda quaint now.
-- JD Baldwin, in the Monastery

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
rsnapshot-discuss mailing list
rsnapshot-discuss < at > lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/rsnapshot-discuss

Display posts from previous:
Reply to topic Page 1 of 1
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
  


Magic SEO URL for phpBB