Problem - Kevin Tafuro

should call pclose( ) to clean up the file descriptors and reap the child process created
by the call to fork( ).
You should also avoid using popen( ) and its accompanying pclose( ) function, but
popen( ) does have utility that is worth duplicating in a secure fashion. The following
implementation with a similar API does not make use of the shell.
If you do wish to use either system( ) or popen( ), be extremely careful. First, make
sure that the environment is properly set, so that there are no Trojan environment
variables. Second, remember that the command you’re running will be run in a Unix
shell. This means that you must ensure that there is no way an attacker can pass
malicious data to the shell command. If possible, pass in a fixed string that the
attacker cannot manipulate. If the user must be allowed to manipulate the input,
only very careful filtering will accomplish this securely. We recommend that you
avoid this scenario at all costs.
The following code implements secure versions of popen( ) and pclose( ) using the
spc_fork( ) code from Recipe 1.6. Our versions differ slightly in both interface and
function, but not by too much.
The function spc_popen( ) requires the same arguments execve( ) does. In fact, the
arguments are passed directly to execve( ) without any modification. If the operation
is successful, an SPC_PIPE object is returned; otherwise, NULL is returned. When
communication with the new program is complete, call spc_pclose( ), passing the
SPC_PIPE object returned by spc_popen( ) as its only argument. If the new program
has not yet terminated when spc_pclose( ) is called in the original program, the call
will block until the new program does terminate.
If spc_popen( ) is successful, the SPC_PIPE object it returns contains two FILE objects:
• read_fd can be used to read data written by the new program to its stdout file
descriptor.
• write_fd can be used to write data to the new program for reading from its stdin
file descriptor.
Unlike popen( ), which in its most portable form is unidirectional, spc_popen( ) is
bidirectional.
#include
#include
#include
#include
#include
#include
typedef struct {
FILE *read_fd;
FILE *write_fd;
pid_t child_pid;
} SPC_PIPE;
Executing External Programs Securely | 31
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.