Posted February 14, 2017
Lin545: edit:
It turns out that piping the arguments using pipe or xargs results them not to be displayed on the process output!
That means command line option is fine, if input is piped like this:
echo $login $pass | xargs lgogdownloader --login
would not cause any security holes.
Unfortunately it would still create the same security hole. Now you have echo process running with the cmdline arguments world readable (and I think it won't exit until lgogdownloader is done reading from the pipe). It turns out that piping the arguments using pipe or xargs results them not to be displayed on the process output!
That means command line option is fine, if input is piped like this:
echo $login $pass | xargs lgogdownloader --login
would not cause any security holes.
Write them to file, then cat the file to xargs. That might be secure, depending on the permissions.
Post edited February 14, 2017 by huan