centos 6
shell weakness #2

4

Weakness Breakdown


Definition:

A shell weakness occurs when a program enables an attacker to execute unexpected commands on the operating system.

Warning code(s):

This causes a new program to execute and is difficult to use safely.

File Name:

gegl-0.1.2/gegl/gegl-dot.c

Context:

The highlighted line of code below is the trigger point of this particular Centos 6 shell weakness.

  * gegl_dot_node_to_png:
 * @node: Node to depict graph for.
 * @png_path: Path of the png to write.
 *
 * This is for debug purposes, meant to be invoked directly from a
 * debugger.
 **/
void
gegl_dot_node_to_png (GeglNode    *node,
                      const gchar *png_path)
{
  gchar      *dot_string   = NULL;
  gchar      *dot_filename = NULL;
  gchar      *dot_cmd      = NULL;

  /* Get dot string */
  dot_string = gegl_to_dot (node);

  /* Write it to a file */
  dot_filename = g_build_filename (g_get_tmp_dir (), "gegl-dot.dot", NULL);
  g_file_set_contents (dot_filename, dot_string, -1, NULL);

  /* Create a png from it */
  dot_cmd = g_strdup_printf ("dot -o %s -Tpng %s", png_path, dot_filename);
  system (dot_cmd);
} 

The registered trademark Linux® is used pursuant to a sublicense from the Linux Foundation, the exclusive licensee of Linus Torvalds, owner of the mark on a world­wide basis.