Timeline for How can I trigger a Notification Center notification from an AppleScript or shell script?
Current License: CC BY-SA 3.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 5, 2017 at 23:47 | comment | added | Alf | If you want to use escaping, you must escape \ -> \\ as well, otherwise \" becomes \\" and you can break out. I changed the example to use an environment variable instead. | |
| S Apr 25, 2017 at 9:28 | history | suggested | Alf | CC BY-SA 3.0 |
Actually fix the remote code execution. Previous version forgot to escape backslash.
|
| Apr 25, 2017 at 8:45 | review | Suggested edits | |||
| S Apr 25, 2017 at 9:28 | |||||
| Apr 13, 2017 at 12:45 | history | edited | CommunityBot |
replaced http://apple.stackexchange.com/ with https://apple.stackexchange.com/
|
|
| Jul 23, 2016 at 8:10 | comment | added | Arc | @EdwardFalk the substitution was missing a slash. Should work now. | |
| Jul 23, 2016 at 8:09 | history | edited | Arc | CC BY-SA 3.0 |
added 1 character in body
|
| Jul 22, 2016 at 19:11 | comment | added | Edward Falk | I just played with it; that idiom seems to only escape one quote. Is there a "global" version? | |
| Jul 22, 2016 at 19:06 | comment | added | Edward Falk | Upvote because it's always good to keep security in mind. Someone could copy-pasta solutions and use them in ways the person posting the solution hadn't considered. | |
| Dec 19, 2015 at 8:47 | comment | added | Arc |
Well, maybe you'd just like to say something like I have a "laser" without being told you're having a syntax error by "quoting" your "words". With escaping, you can: script 'I have a "laser"'
|
|
| Dec 18, 2015 at 23:30 | comment | added | iconoclast | okay, that's true. it's just hard for me to imagine ever putting content from web forms into my notifications, but your point is taken. | |
| Dec 18, 2015 at 21:54 | comment | added | Arc | If you display user content that is not from you, you are vulnerable. For example if you run this on a system with a public web server, or when some app logs strings it got from the net which you read and display, e.g. a browser, mail program or a Twitter client. It could have a " to end the string and statement, then have code and then restart a string. | |
| Dec 18, 2015 at 15:49 | comment | added | iconoclast | this is interesting, but can you describe a scenario where a script I run on my system that is only user-executable is vulnerable to script injection? | |
| May 14, 2015 at 12:23 | history | answered | Arc | CC BY-SA 3.0 |