Vulnerable to arbitrary command execution

[cdown]

Hi,

Just to let you know, your use of system() is vulnerable to arbitrary command execution (this situation is especially bad since it can be invoked by anyone over IRC). Filtering characters is not enough. Don't use system(), use a real subprocess spawner that doesn't involve using a shell.

[cdown]

Specifically, because $title is not sanitised and $topic can be arbitrary.

[Someguy123]

I was just about to install this script until I saw this issue. Thank's for posting this. This issue is terrifying and really needs to be fixed.

[ghost]

I just remembered I wrote this awhile back, ended up throwing generic libnotify support for a friend as well since I pretty much don't use macOS anymore.

I use fork() exec() so it shouldn't be vulnerable to this same problem as I'm not executing a shell.
It should also be a hell of a lot faster, If you get bombarded with like 20 messages at once, since it does fork(); useful if you use a BNC.

https://github.com/GeneralUnRest/irssi-mac-notify