[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <q8994647-p2o4-241s-5qso-74r84r19399r@vanv.qr>
Date: Thu, 19 Oct 2023 02:42:01 +0200 (CEST)
From: Jan Engelhardt <jengelh@...i.de>
To: oss-security@...ts.openwall.com
Subject: Re: with firefox on X11, any page can pastejack you
anytime
On Thursday 2023-10-19 00:31, Grant Taylor wrote:
>
> Aside: The thread in question brought up some interesting idea, including
> altering how things that start with unsafe characters -- though I wonder why
> not all files -- with `./` so the `-bob` file becomes `./-bob` when expanded.
> -- I wondered about prefixing globing with `--` which is the de-facto don't
> process anything after this as a command line flag.
Humans have a habit of specifying the most important thing first, not
only in natural language, but also commands. This reflects in
command, e.g. `ls -l *z --color=never`. Forgot something? `!ls
--human-readable`, there, more stuff appended to the end. Nobody
likes to do cursor movement, and nobody likes retyping the command
from the start to meet the POSIX pedantism that requires all options
before the first non-option (operand).
For this reason, POSIXLY_CORRECT=1 is unpopluar, and so would,
unfortunately, be your suggestion to stop option processing at a
wildcard with an implicit "--" (which would become explicit "--" for
the program's argv).
The ./ suggestion has some merit, though this leads to programs
acting differently, e.g. `tar --strip=N` .
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
