CID 47544: Use of untrusted string value (CWE-20)

[mmaraya]

ftp/cmds.c#L1481

tainted_string_return_content: getenv returns tainted string content.
var_assign: Assigning: theshell = getenv("SHELL"), which taints the shell.

ftp/cmds.c#L1500

tainted_string: Passing tainted string theshell to execl, which cannot accept tainted data.

The string may be incorrectly assumed to not contain certain metacharacters or element names in later operations. In shell: An unscrutinized string from an untrusted source used in a trusted context (CWE-20)