On Wed, 8 Aug 2018 at 02:46, Scott Moser <email address hidden> wrote:
> @mwhudson,
> your suggested change seems reasonable to me.
> I don't love the use of 'eval', but it seems reasonably safe here.
>
I don't either, but I don't think there is any alternative here is there?
> Instead of quoting you could just reject argv[1] input if it
> had characters other than [a-zA-z_.-] . Perhaps that makes
> this more difficult.
>
If I'd thought of this before writing the quote function I'd probably have
gone for it...
> Also, maybe you should try to 'setlocale(argv[1])' to check that
> it is valid ? Ie, as it is right now if input is bogus then
> the program will exit success and write bogus output.
>
Hmm maybe that would make sense. OTOH given the circumstances it's called
in I'm not sure this is very important.
I could ameliorate both your points by just hardcoding the default locale
to C.UTF-8...
On Wed, 8 Aug 2018 at 02:46, Scott Moser <email address hidden> wrote:
> @mwhudson,
> your suggested change seems reasonable to me.
> I don't love the use of 'eval', but it seems reasonably safe here.
>
I don't either, but I don't think there is any alternative here is there?
> Instead of quoting you could just reject argv[1] input if it
> had characters other than [a-zA-z_.-] . Perhaps that makes
> this more difficult.
>
If I'd thought of this before writing the quote function I'd probably have
gone for it...
> Also, maybe you should try to 'setlocale( argv[1] )' to check that
> it is valid ? Ie, as it is right now if input is bogus then
> the program will exit success and write bogus output.
>
Hmm maybe that would make sense. OTOH given the circumstances it's called
in I'm not sure this is very important.
I could ameliorate both your points by just hardcoding the default locale
to C.UTF-8...