Sanitize user input in drop.go

[tedteng]

Describe the bug

Sanitize user input when executing local commands as much as possible

This is one of the sub-task for ticket #267

[neo-liang-sap]

duplicate with my PR #324

[tedteng]

duplicate with my PR #324

I think this ticket is more about sanitize bash -c

and the issue ticket you are working is seems more about refacot the ExecCmd function itself which I mention #320 (comment), but you can check with Peter for more information.

ExecCmd should not be called with a cmd string and instead the caller should pass the name and arguments directly for exec.Command, otherwise an attacker could sneak in arguments

[neo-liang-sap]

totally not getting your point, for my PR i'm refactoring ExecCmdReturnOutput in drop.go

[tedteng]

totally not getting your point, for my PR i'm refactoring ExecCmdReturnOutput in drop.go

so if you are not working on refactor ExecCmd function issue #267 (comment). I will create a new issue ticket for that?

[neo-liang-sap]

/close
as pr merged