Secure Programming Techniques 2019/20 spring

Homework 3 - deadline May 19th

Find all potential vulnerabilities in this script:

#!/bin/sh
# process the files with name pattern matching regular expression
# with downloaded "extract-info" (whatever that is) and then remove them

curl -s http://www.example2.com/extractor-installer | sudo bash

echo -n "Enter directories: "
read dirs

echo -n "Enter filename regular expression: "
read pattern

find $dirs > /tmp/result

cmd='extract-info `grep '$pattern' /tmp/result`'
echo "Running command $cmd"
eval $cmd

cmd='rm `grep '$pattern' /tmp/result`'
echo "Running command $cmd"
eval $cmd

rm /tmp/result

Please submit the homework below (log in to courses.cs.ut.ee environment with your ut.ee account), plain text is sufficient but PDF is also OK: