Need to issue a DOS command from within a native COBOL program

In my COBOL program I would construct a DOS command like "copy EDITFILE.txt EDITFILE-Finance.txt"

Question:  how can I cause the COBOL program to actually issue that command?

Parents
  • The CALL "SYSTEM" API, as Wascar and Stephen have discussed, is the recommended way to do this.

    However, please be aware that using the SYSTEM API or any other means of executing shell commands from a program is a serious security risk. Unless you are very careful to construct command lines only from untainted data, you have a potential injection vulnerabilty. It is almost always better to use specific APIs for the tasks you need to accomplish.

    In this case, MF COBOL provides a CBL_COPY_FILE API, described in the product documentation, which will copy a file without creating an injection vulnerability. (There may be other security issues, such as information disclosure, information corruption, and TOCTOU vulnerabilities, but those are more limited in scope and harder to exploit.)
Reply
  • The CALL "SYSTEM" API, as Wascar and Stephen have discussed, is the recommended way to do this.

    However, please be aware that using the SYSTEM API or any other means of executing shell commands from a program is a serious security risk. Unless you are very careful to construct command lines only from untainted data, you have a potential injection vulnerabilty. It is almost always better to use specific APIs for the tasks you need to accomplish.

    In this case, MF COBOL provides a CBL_COPY_FILE API, described in the product documentation, which will copy a file without creating an injection vulnerability. (There may be other security issues, such as information disclosure, information corruption, and TOCTOU vulnerabilities, but those are more limited in scope and harder to exploit.)
Children
No Data