From the course: Secure Coding in C

Unlock the full course today

Join today to access over 22,600 courses taught by industry experts or purchase this course individually.

Using the system() call

Using the system() call - C Tutorial

From the course: Secure Coding in C

Start my 1-month free trial

Using the system() call

“

- [Instructor] The system() function allows direct access to the operating system. This level of control means you must be cautious with the commands sent. In this example, the command sent is static text shown at line 10. Providing the command is specified as safe and contains no potential for unintended consequences, this code is fine. And here's the Windows version of the same code, which also sends a static text string to the system() function. This code however represents a problem. The command's sent to the system just as if it was typed at the command prompt is supplied by the user. Input is gathered at line nine. The input function, the fgets function, would then be validated which isn't in this code, but unless it's parsed or filtered, it's whisked off to the operating system at line 11. The user could type any deleterious command and the computer dutifully obeys. Now you have several ways to address this…

Contents