On Tue, Oct 03, 2017 at 03:07:24AM +0100, Al Viro wrote:
> That essay is full of shit, and you've even mentioned parts of that just
> above...
> NAK; you'd _still_ need proper quoting (or a shell with something resembling
> an
> actual syntax, rather than the "more or less what srb had ended up
> implementing"),
> so it doesn't really buy you anything. Badly written script will still be
> exploitable. And since older kernels and other Unices are not going away,
> you would've created an inconsistently vulnerable set of scripts, on top of
> the false sense of security.
Banning certain characters is certainly not a panacea, and there are a
lot of best practices that you have to follow when writing good
scripts which most people don't follow, and so it's arguable that
benefits are being overstated.
That being said the costs of suppressing certain bytes from appearing
in pathnames seem fairly low. Would this be more palatable if the ban
on control characters were made into a compile-time or mount-time
option?
- Ted
