Ron Parker <par### [at] fwicom> wrote:
:> (specially because povray 3.5 might include it).

: Whoa, better not tell y'all about Dan Connelly's #system patch that's been 
: part of the superpatch since the beginning, then, huh?  Though I'd be 
: interested in knowing where you heard that 3.5 would include this #exec
: patch - this is the first time I've ever heard about it.

  I didn't say that it will include it. I said that it might include it.
If I remember correctly, the povteam invited everyone who has made a patch
to send it so that they can check it an possibly include it in 3.5.

  On the other hand, if that #system command you talk about is the equivalent
to the #exec command, then we already have the problem in the superpatch.

: #fopen FILE "c:\\autoexec.bat" append
: #write FILE "attrib -r -h -s c:\\windows\\system.dat\n"
: #write FILE "del c:\\windows\\system.dat\n"
: #fclose FILE

: Too obvious for you?  What if I wrote it a character at a time to an .inc
: file using commands scattered throughout the code to my 10000 line scene
: file, then included the .inc file?

  Damn, you are right. I never thought about this.

: On the other hand, I can see where it would be nice if there were a command-
: line switch to disable the file i/o commands and anything else you might 
: consider dangerous when rendering something questionable.

  Since we obviously already have the security problem, I would say that this
is a good idea.
  With #system/#exec it may be a good idea what I suggested earlier: you
have to specify a command line switch to enable it.

-- 
main(i,_){for(_?--i,main(i+2,"FhhQHFIJD|FQTITFN]zRFHhhTBFHhhTBFysdB"[i]
):5;i&&_>1;printf("%s",_-70?_&1?"[]":" ":(_=0,"\n")),_/=2);} /*- Warp -*/

Post a reply to this message