Search code examples
c++cgirights

c++ system call security issue

I develop a c++ CGI app that is used under Windows and Linux. It has to start another app. Currently I am using a system call:

system("anotherApp.exe -arguments");

For that call I need execute rights for cmd.exe on windows cause the system call starts a shell. This is a security concern since my app is a CGI app and used on a webserver.

Is there another possibiliy to call an app without starting a new shell?

Solution

  • System() launches a Console Window and runs the program in that console window.

    popen() runs the program without a console Window, and redirects console output to a pipe.

    CreateProcess() just launches the program. You pass a flags argument telling it what to do with consoles. It also allows the program to run with different permissions to the parent program.

    If you have no rights for cmd.exe, then system() is off the menu.

    popen() may work, as long as the program doesn't need to write to stdout or stderr as that will be lost.

    You might be best to write simething like this:

    bool RunProgram(const std::string &sProgram, bool bWaitForFinish)
{
#if defined(Win32)
    // Launch with CreateProcess()
    // wait if required
#else
    // launch with fork()/exec() or even system()
    // wait if required
#endif
    return error_status;
}