[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <a12cddb8-7753-5e5f-de0f-8c575c2632d2@thermi.consulting>
Date: Mon, 9 Dec 2019 16:28:35 +0100
From: Noel Kuntze <noel.kuntze+oss-security@...rmi.consulting>
To: oss-security@...ts.openwall.com
Subject: Re: Shell wildcards considered dangerous?
Hello Leonid,
The message was about the attack vector on applications that put together argument vectors
based on user input, not specifically about human use of the shell.
The same problem applies to that though. Users need to use -- to terminate the option list.
Kind regards
Noel
Am 09.12.19 um 16:18 schrieb Leonid Isaev:
> On Mon, Dec 09, 2019 at 03:42:47PM +0100, Noel Kuntze wrote:
>> That is only a problem if the developer(s) foolishly didn't use "--" to
>> terminate the command line options or they did, but the argument parser of
>> the called program does not understand that "--" is a command line option
>> terminator.
> I'm sorry, but this has nothing to do with developers of PROGRAM to use or not
> user "--", but rather with the user not properly sanitizing the input to the
> PROGRAM and not understanding how shell works. Specifically, doing
> PROGRAM *.tar is just asking for trouble for many reasons, not mentioned in the
> original email. See [1] (and in general BashPitfalls) for a proper discussion...
>
> HTH,
> L.
>
> [1] https://mywiki.wooledge.org/BashPitfalls#for_f_in_.24.28ls_.2A.mp3.29
>
--
Noel Kuntze
IT security consultant
GPG Key ID: 0x0739AD6C
Fingerprint: 3524 93BE B5F7 8E63 1372 AF2D F54E E40B 0739 AD6C
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
