<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Nov 27, 2020, at 9:44 AM, Lars Kiesow <<a href="mailto:lkiesow@uos.de" class="">lkiesow@uos.de</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hi everyone,<br class="">I'm trying to mask the caller_id_name in a FreeSWITCH dialplan to<br class="">prevent the real phone numbers to show up in our conferencing software.<br class="">Someone sent me the following lines:<br class=""><br class=""> <action application="set" data="MASK=${system echo ${caller_id_name} | grep -o -P '.{0,4}$' | sed 's/^/xxx-xxx-/' }"/><br class=""> <action application="set_profile_var" data="caller_id_name=${MASK}"/><br class=""><br class="">While this works perfectly and does exactly what I want, I'm unsure<br class="">about potential security risks.<br class=""></div></div></blockquote><div><br class=""></div>Its a good thing to be concerned with, yes thats real</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><br class="">The caller_id_name ends up in a shell command after all and I'm<br class="">wondering if someone could send a name like `; rm /*` (you get the<br class="">idea).<br class=""><br class="">Is this safe? Is the caller_id_name sanitized? Is there a better way to<br class="">do something like this?<br class=""><br class=""></div></div></blockquote><div><br class=""></div>No not safe. Check out <a href="https://freeswitch.org/confluence/display/FREESWITCH/mod_dptools:+regex" class="">https://freeswitch.org/confluence/display/FREESWITCH/mod_dptools%3A+regex</a></div><div><br class=""></div><div><br class=""><blockquote type="cite" class=""><div class=""><div class="">Best regards,<br class="">Lars<br class=""></div></div></blockquote></div><br class=""></body></html>