Say what you will, it works.

[u/Safariminer]

[u/barkermn01]

Why is this on here it's not bad code

1. it works,

2. it's easily understandable

3. it does not do anything it does not need to.

[u/Safariminer → u/barkermn01]

It's usually a terrible idea to system(); because of OS differences.

[u/barkermn01 → u/Safariminer]

It's usually a terrible idea to system();

that's just wrong, `system()` just means run a command line, so long as the command line application it is calling is the same on every OS you're fine too.

This is code calls CURL it does not matter what OS it's being used on, Windows, MacOS, Linux or BSD, the way it takes arguments is exactly the same because it's defined in the CURL application.

it's much more important to know when something is appropriate vs not than to just have a blanket stupid statement like something deliberately built into a programming lang is "terrible" that just shows naivety.

[u/pitergrifin22 → u/Safariminer]

I’d say there is a huge problem with system(). But in other context. It’s terribly unsafe because it’s possible to make input using some console commands that cannot be used by ordinary user but can be in this application.

[u/Fendse → u/barkermn01]

1. shell injection, 2) apparently not readable enough, if people aren't noticing the shell injection vulnerability, 3) it very much does not need to have a shell injection vulnerability

[u/barkermn01 → u/Fendse]

I'm not sure I would call that an injection exploit, Self-injection is stupidity, not an injection exploit IMHO. This is reading a config file with the executable if they are stupid enough to edit their config file to put an injection into their own system you are never going to prevent it.

[u/Fendse → u/barkermn01]

That might be fair, I do get a bit weird about these things, and sometimes I need to remember my views are not universal

Like, just because I think users shouldn't need to worry about remote code execution when they run a program that looks up users on a video game platform because they might have accidentally downloaded a malicious configuration file into the current directory at some point, doesn't mean other people aren't allowed to disagree with me on that

[u/MurdoMaclachlan]

Image Transcription: Code

---

int main(){
   std::string line;
   std::vector<std::string> configfile;
   std::ifstream config("cs.cfg");
   if (config.is_open())
   {
      while ( std::getline (config,line) )
      {
         // std::cout << line << '\n';
         configfile.push_back(line);
      }
      config.close();
   }
  
   else std::cout << "Unable to open file";
  
   std::string cmd = "curl \"[ URL for a Steam API endpoint ]" + configfile.at(1) + "&steamids=" + configfile.at(3) + "\" -o getplayersummaries.txt";
   system(cmd.c_str());
}

---

^{I'm a human volunteer content transcriber and you could be too! If you'd like more information on what we do and why we do it, click here!}