Re: strange things plugins

On Sun, 2 Jan 2005, Renaud Deraison wrote:

> > rand() is not a safe way to make temporary filenames.
> 
> Who cares ? The temporary files are created in a protected directory
> that only root can write in.

1. Are you sure two concurrently running scripts cannot pick the same
   temporary filename? (This leads to a related and quite interesting
   question of the behaviour of nasl_rand() in forked processes...)

2. It might fail back to /tmp when a private directory is unavailable.

> > pread() arguments with embedded apostrophes or quotation marks in 
> > ssh_get_info.nasl look suspicious.
> 
> I could not find any occurence where the quotes where used
> inappropriately. The arguments to the 'rpm' commands are ok and do
> contain quotes on purpose.

Try
	pread(cmd:"echo", argv:make_list("'a'"))
and
	ssh_cmd(socket:sock, cmd:"echo 'a'")

Are the results identical?

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."

_______________________________________________
Nessus-devel mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus-devel