[osol-arc] Re: [ksh93-integration-discuss] Re: Korn Shell 93 Integration [PSARC-EXT/2006/550 Timeout: 09/27/2006]

[Felix Schulte]

On 9/26/06, James Carlson <james.d.carlson at sun.com> wrote:
> April Chin writes:
> > > Incompatibility (9)...  Does this mean pattern matching in the same
> > > statement/command?  Or subsequently for the rest of the script?  Sounds
> > > like a bug.
> >
> > >From the COMPAT file:
> >
> > 9) In ksh93, pattern matching following a redirection symbol works only
> >    in interactive shell, not in scripts.
> >
> > The above refers to pattern matching in the same statement.
> > For example, in a ksh93 script, "echo hi >> foo*" will write to the file
> > literally named "foo*" rather than to a file whose name matches the pattern
> > (starts with the string "foo")  In Solaris ksh, the same script will
> > write to a file matching the pattern.  I'll add the example.
>
> That one is a surprising change, particularly so because it's
> dependent on something apparently unrelated to the problem (the result
> of isatty(0), I assume).  I think it'll need to be discussed in the
> context of that future ksh replacement case.
Why? This is not stupid. The pattern could expand to multiple files
which can be used to exploit holes in setuid shell scripts. For
example foo* could expand to "foo ;
evilprogramwhichtakesoverthemachine" and then the box gets f*cked by
some evil hacker
-- 
      _        Felix Schulte
    _|_|_     mailto:felix.schulte at gmail.com
    (0 0)
ooO--(_)--Ooo