Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 12 Dec 2012 11:51:33 -0500 (EST)
From: Jan Lieskovsky <>
To: "Steven M. Christey" <>,
        Nick Treleaven <>,
        Colomban Wendling <>,
        Enrico Troeger <>,
        Matthew Brush <>,
        Frank Lanitz <>,,
Subject: Geany IDE not escaping filenames during compilation / build - a
 security issue or not?

Hello Kurt, Steve, vendors,

  Background: Geany is a small and fast integrated development enviroment with basic
features and few dependencies to other packages or Desktop Environments.

Based on (you might need to click 'Yes, I agree' OK to
get the exploit code in [2]):

it was found that Geany is not escaping filenames (when compiling /
building source) prior passing the final command line to shell.

The questions:
1) should Geany escape the filenames?,
2) is this a security issue or not?

Two views:
* view #1 - it shouldn't escape the filenames. It's just IDE,
so what it obtains as input is passed to shell for execution.

* view #2 - it should escape the filenames (because this is what
shell / bash is doing) prior making the build.

Obviously, even for gcc you can pass specially-crafted filename,
when attempt to build it would lead to "ls -la" command (for example)
to be executed.

I by myself am not sure / not able to decide here.

Steve, could you hint? Does Mitre have some guidance / document,
how to deal with cases like this one?

Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Response Team

P.S.: Cc-ed Geany maintainers for their opinion too.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.