Let's say I have a script:

<br/>echo -n &quot;$1&quot; | some_bin &quot;$2&quot; &quot;$3&quot; -t &quot;$4&quot; -m &quot;$5&quot; -p &quot;$6&quot; -e<br/>

I call this from my application using Erlang's ports, passing

<br/>{spawn_executable, &quot;sh&quot;},<br/>{args, [&quot;myscript.sh&quot;, Arg1, Arg2, Arg3, ...]}<br/>

Argument 1 (which goes to the echo) is user controlled, the others are not. How can a malicious user crack this? What kind of shenanigans can they do in the shell script? What do I need to do to avoid that?

(some_bin only takes input from stdin.)

#Erlang