Re: Iceweasel annoyance

[Celejar <celejar@gmail.com>]

On Mon, 23 Nov 2009 10:00:40 +0000
Clive Standbridge <Clive.Standbridge@myriadgroup.com> wrote:

> Michelle Konzack wrote:
> > 
> > I am using a script to run mutt:
> > 
> > ----[ '~/bin/mutt_firefox' ]--------------------------------------------
> > #!/bin/sh
> > 
> > xterm -geometry 80x45+400+100 -u8 -e mutt -e "set editor=mcedit" $1
> > ------------------------------------------------------------------------
> > 
> > Which generaly works, IF the "mailto:";; link does not use something
> > like
> > 
> >     ?subject=something
> > 
> > attached.
> 
> I suspect that's because your $1 is not quoted. For good measure I'm
> using 
>       -- "$@"
> where you have
>       $1

And without the quotes, one wrong click and she's toast:

"Note that the quotes around the $1 in my script are crucial from a
security point of view. Imagine the consequences of you clicking on a
link like this:

    mailto:someone@somedomain.tld; rm -Rf $HOME/*

Without the quotes, my script would end up doing this:

    sylpheed --compose mailto:someone@somedomain.tld; rm -Rf $HOME/*

...which could have unpleasant consequences..."

http://howto-pages.org/mozilla.php

Celejar
-- 
foffl.sourceforge.net - Feeds OFFLine, an offline RSS/Atom aggregator
mailmin.sourceforge.net - remote access via secure (OpenPGP) email
ssuds.sourceforge.net - A Simple Sudoku Solver and Generator