134
Critical Rust flaw enables Windows command injection attacks
(www.bleepingcomputer.com)
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Follow the wormhole through a path of communities !webdev@programming.dev
The only semi-realistic way I can see Bash becoming mostly obsolete is with a tool that provides automated migration of large scripts, and the only project I know of that's even attempting that is Oil: https://www.oilshell.org/
But for spawning a command in a subprocess, there really ought to be a standard OS API that doesn't involve invoking a shell at all. I expect that most or all implementations of
posix_spawn
andexecve
don't invoke a shell, but the standard call to start a process on Windows,CreateProcess
, apparently does involvecmd.exe
for some bizarre reason, and that's why this is a problem in the first place.