examples-secure/command-injection/command-injection.c


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

#include <stdlib.h>
#include <string.h>

int main(int argc, char **argv)
{
	int argl = strlen(argv[1]);
	char cmd[argl + 6];

	for (int i = 0; i < argl; i++)
		if (argv[1][i] == ';' || argv[1][i] == '|' || argv[1][i] == '&')
			argv[1][i] = ' ';
	strcpy(cmd, "echo ");
	strcat(cmd, argv[1]);
	system(cmd);

	return 0;
}