Question

From a C program I want to call a shell script with a filename as a parameter. Users can control the filename. The C is something like (initialization/error checking omitted):

sprintf(buf, "/bin/sh script.sh \"%s\"", filename);
system(buf);

The target device is actually an embedded system so I don’t need to worry about malicious users. Obviously this would be an attack vector in a web environment. Still, if there is a filename on the system which, for example, contains backquotes in its name, the command will fail because the shell will perform expansion on the name. Is there any to prevent command substitution?

Answer 1

Well, you could always reimplement system() using a call to fork() and then execv().

http://www.opengroup.org/onlinepubs/000095399/functions/system.html