I don't know how they managed to do it, but on the mobile version of the site, none of the useful links are actually links...
Show HN: Libcox – A C Library for Cross-Platform System Calls
21–30 of 31 posts
Re: Show HN: Libcox – A C Library for Cross-Platform System Calls
#22rc = libcox_exec_fmt(pHandle,&pResult,"ls '%s'",zDir); /*Don't forget the single quotes around 'zDir' */ This is either insecure, or so different from a shell as to make it not worth using shell syntax. I really like the concept though. Took me to figure out what the concept is because "system calls" doesn't mean "shell commands" to me, but having figured that out, operating on shell commands has a lot of things goin…
Hi, this is due to the fact that zDir may contain spaces especially under windows which confuse the command processor to interpret it as multiple arguments and not a single one as with single or double quotes (http://libcox.net/arch.html)
Re: Show HN: Libcox – A C Library for Cross-Platform System Calls
#23rc = libcox_exec_fmt(pHandle,&pResult,"ls '%s'",zDir); /*Don't forget the single quotes around 'zDir' */ This is either insecure, or so different from a shell as to make it not worth using shell syntax. I really like the concept though. Took me to figure out what the concept is because "system calls" doesn't mean "shell commands" to me, but having figured that out, operating on shell commands has a lot of things goin…
Hi, this is due to the fact that zDir may contain spaces especially under windows which confuse the command processor to interpret it as multiple arguments and not a single one as with single or double quotes ( http://libcox.net/arch.html )
What happens if zDir contains single quotes?
Re: Show HN: Libcox – A C Library for Cross-Platform System Calls
#24Earlier quoted context omitted.
Hi, this is due to the fact that zDir may contain spaces especially under windows which confuse the command processor to interpret it as multiple arguments and not a single one as with single or double quotes ( http://libcox.net/arch.html )
What happens if zDir contains single quotes?
You need to escape them, like in every other instance where strings may contain control characters.
That'd be my guess, at least, but, i guess, single quotes aren't valid characters for zDir.
Re: Show HN: Libcox – A C Library for Cross-Platform System Calls
#25Earlier quoted context omitted.
What happens if zDir contains single quotes?
You need to escape them, like in every other instance where strings may contain control characters. That'd be my guess, at least, but, i guess, single quotes aren't valid characters for zDir.
So what are the quote parsing rules for libcox, and given an arbitrary string, how do I correctly escape them?
(In the absence of this, and certainly in the absence of official docs/examples that do the right thing, that's a security vulnerability waiting to happen.)
Re: Show HN: Libcox – A C Library for Cross-Platform System Calls
#26Why use command processing (e.g. `libcox_exec(pHandle,&pResult,"uname",-1)`) rather than plain function (could be `libcox_uname(pHandle, &pResult)` for instance) ?
Re: Show HN: Libcox – A C Library for Cross-Platform System Calls
#27Aside from being C and "lightweight" I wonder when you'd want to pick this instead of POCO or ACE...
This project is using the phrase "system call" idiosyncratically / incorrectly: by it they mean "calls to the system() function", not "low-level OS facilities". POCO and ACE seem to be about actual system calls (network programming, threads, pipes, etc.) They're for very different purposes.
libcox is for when your existing code would do something like system("uname") or system("ls") (... except not even with system(), with popen() or something), and you want it portable to Windows.
Re: Show HN: Libcox – A C Library for Cross-Platform System Calls
#28Earlier quoted context omitted.
You need to escape them, like in every other instance where strings may contain control characters. That'd be my guess, at least, but, i guess, single quotes aren't valid characters for zDir.
So what are the quote parsing rules for libcox, and given an arbitrary string, how do I correctly escape them? (In the absence of this, and certainly in the absence of official docs/examples that do the right thing, that's a security vulnerability waiting to happen.)
String escaping follows the same rules of C/C++ or you could use the str_escape command to do job for you.
Re: Show HN: Libcox – A C Library for Cross-Platform System Calls
#29Why use command processing (e.g. `libcox_exec(pHandle,&pResult,"uname",-1)`) rather than plain function (could be `libcox_uname(pHandle, &pResult)` for instance) ?
no need to release a new version by a adding a new public API function each time a command is added. You would simply create a new foreign command in your application, register it via libcox_register_command()[1] without modifying the library core.
Re: Show HN: Libcox – A C Library for Cross-Platform System Calls
#30rc = libcox_exec_fmt(pHandle,&pResult,"ls '%s'",zDir); /*Don't forget the single quotes around 'zDir' */ This is either insecure, or so different from a shell as to make it not worth using shell syntax. I really like the concept though. Took me to figure out what the concept is because "system calls" doesn't mean "shell commands" to me, but having figured that out, operating on shell commands has a lot of things goin…
Hi, this is due to the fact that zDir may contain spaces especially under windows which confuse the command processor to interpret it as multiple arguments and not a single one as with single or double quotes ( http://libcox.net/arch.html )
Why do you take care of space escaping but not others (quotation marks)? This might lead to false expectations, i.e. that you take care of everything, security-wise.