From ae01ba26c12ce7ad7f0a4edc8139c5b5b96f7f96 Mon Sep 17 00:00:00 2001 From: steven Date: Tue, 26 Nov 2024 17:35:23 +0000 Subject: [PATCH] Do not use `quotemeta` on `cmdv4` and `cmdv6` arguments `quotemeta` prevents executing commands with arguments. With this change, it is now possible to get an IP address with: usev4=cmdv4 cmdv4="dig +short myip.opendns.com @resolver1.opendns.com" --- ddclient.in | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/ddclient.in b/ddclient.in index 5047eb9..c91d100 100755 --- a/ddclient.in +++ b/ddclient.in @@ -3343,8 +3343,7 @@ sub get_ipv4 { warning("'--cmd-skip' ignored for '--usev4=$p{'usev4'}'") if opt('verbose') && defined($p{'cmd-skip'}); if ($arg) { - my $sys_cmd = quotemeta($arg); - $reply = qx{$sys_cmd}; + $reply = qx{$arg}; $reply = '' if $?; } } elsif ($p{'usev4'} eq 'webv4') { @@ -3457,8 +3456,7 @@ sub get_ipv6 { warning("'--cmd-skip' ignored for '--usev6=$p{'usev6'}'") if opt('verbose') && defined($p{'cmd-skip'}); if ($arg) { - my $sys_cmd = quotemeta($arg); - $reply = qx{$sys_cmd}; + $reply = qx{$arg}; $reply = '' if $?; } } elsif ($p{'usev6'} eq 'webv6' || $p{'usev6'} eq 'web') {