Hacker News new | ask | show | jobs
by douchescript 3825 days ago
Xargs with crawled data sounds like a nightmare. Allow me to link to example.com?$(rm -rf /).
1 comments
nothrabannosir 3825 days ago
xargs doesn't pass its arguments to the shell, it directly invokes exec:

    $ echo 'test   $(foo   bar)   test' | xargs echo
    test $(foo bar) test
    $ echo 'test   $(foo   bar)   test' | xargs python -c 'print(len(__import__("sys").argv))'
    5
the $ and ( are nothing special to xargs, nor to echo (or wget).

Not to say yay xargs is always great, just that this specific counter example doesn't hold up.

link