From 808a4f15ce82d2ed7eeb06de73d0f313620558ee Mon Sep 17 00:00:00 2001 From: Andrew Gregory Date: Sun, 9 Jun 2019 09:56:36 -0700 Subject: run XferCommand via exec system() runs the provided command via a shell, which is subject to command injection. Even though pacman already provides a mechanism to sign and verify the databases containing the urls, certain distributions have yet to get their act together and start signing databases, leaving them vulnerable to MITM attacks. Replacing the system call with an almost equivalent exec call removes the possibility of a shell-injection attack for those users. Signed-off-by: Andrew Gregory --- src/pacman/conf.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'src/pacman/conf.h') diff --git a/src/pacman/conf.h b/src/pacman/conf.h index f45ed436..47df979d 100644 --- a/src/pacman/conf.h +++ b/src/pacman/conf.h @@ -125,6 +125,8 @@ typedef struct __config_t { alpm_list_t *noextract; alpm_list_t *overwrite_files; char *xfercommand; + char **xfercommand_argv; + size_t xfercommand_argc; /* our connection to libalpm */ alpm_handle_t *handle; -- cgit v1.2.3-24-g4f1b