ionrock / procs Goto Github PK

As mentioned in the reddit post associated with this projects announcement there are some security concerns with this library I believe should at least be clearly documented. While I accept API design is subjective, I believe expanding environment variables and then parsing them as POSIX command lines as demonstrated below is particularly dangerous:

os.Setenv(`VAR`, `FOO | do-rm-rf-cmd`)
p := procs.NewProcess("echo ${VAR}")
fmt.Println(p.Run())
// exec: "do-rm-rf-cmd": executable file not found in $PATH

Even if this project takes the stance that all user input must be trusted and providing safety mechanisms for mistakes is not a worthwhile endeavor- it has the potential for some surprising side affects in regular everyday usage. For example it's not uncommon for "secrets" to contain POSIX shell command characters os.Setenv("SECRET_API_KEY", "K|0HDctF*!$(JF") so it may be worth reconsidering since I can't really think of a use case for this.

exePath, _ := filepath.Abs(filepath.Join(wd, "file.exe"))
p := procs.NewProcess(exePath+ " faststart")
err := p.Run()

path:

D:/测试/main.exe

program crashed with output:

Uknown rune: 27979