[Bug 338956] [NEW] doesn't sanitize command line inputs
Public bug reported: Binary package hint: checkinstall (Hardy, checkinstall version: 1.6.1-5ubuntu1) When using an option like --requires 'foo (>=1.0)' checkinstall interprets that parameter: --requires) shift REQUIRES=`eval echo $1` ;; Which leads to some warnings: /usr/bin/checkinstall: eval: line 494: syntax error near unexpected token `(' /usr/bin/checkinstall: eval: line 494: `echo foo (>=1.0)' I think that's not as it should be. One expects the given options to be used as provided and not to be interpreted. If I want to use a command's output I'd use --requires "$(somecommand)", not --requires \`somecommand\`. While looking around found another problem: function shell_escape() { for str in "$@" ; do echo -n "\"$str\" " done; echo } This interprets variables and other $... stuff in $str, if there is a " in $str, it gets even worse. It should for example be escaped with single quotes (and single quotes in the string replaced with '\'') ** Affects: checkinstall (Ubuntu) Importance: Undecided Status: New -- doesn't sanitize command line inputs https://bugs.launchpad.net/bugs/338956 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 338956] [NEW] doesn't sanitize command line inputs
Public bug reported: Binary package hint: checkinstall (Hardy, checkinstall version: 1.6.1-5ubuntu1) When using an option like --requires 'foo (>=1.0)' checkinstall interprets that parameter: --requires) shift REQUIRES=`eval echo $1` ;; Which leads to some warnings: /usr/bin/checkinstall: eval: line 494: syntax error near unexpected token `(' /usr/bin/checkinstall: eval: line 494: `echo foo (>=1.0)' I think that's not as it should be. One expects the given options to be used as provided and not to be interpreted. If I want to use a command's output I'd use --requires "$(somecommand)", not --requires \`somecommand\`. While looking around found another problem: function shell_escape() { for str in "$@" ; do echo -n "\"$str\" " done; echo } This interprets variables and other $... stuff in $str, if there is a " in $str, it gets even worse. It should for example be escaped with single quotes (and single quotes in the string replaced with '\'') ** Affects: checkinstall (Ubuntu) Importance: Undecided Status: New -- doesn't sanitize command line inputs https://bugs.launchpad.net/bugs/338956 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 338956] [NEW] doesn't sanitize command line inputs
Public bug reported: Binary package hint: checkinstall (Hardy, checkinstall version: 1.6.1-5ubuntu1) When using an option like --requires 'foo (>=1.0)' checkinstall interprets that parameter: --requires) shift REQUIRES=`eval echo $1` ;; Which leads to some warnings: /usr/bin/checkinstall: eval: line 494: syntax error near unexpected token `(' /usr/bin/checkinstall: eval: line 494: `echo foo (>=1.0)' I think that's not as it should be. One expects the given options to be used as provided and not to be interpreted. If I want to use a command's output I'd use --requires "$(somecommand)", not --requires \`somecommand\`. While looking around found another problem: function shell_escape() { for str in "$@" ; do echo -n "\"$str\" " done; echo } This interprets variables and other $... stuff in $str, if there is a " in $str, it gets even worse. It should for example be escaped with single quotes (and single quotes in the string replaced with '\'') ** Affects: checkinstall (Ubuntu) Importance: Undecided Status: New -- doesn't sanitize command line inputs https://bugs.launchpad.net/bugs/338956 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 338956] [NEW] doesn't sanitize command line inputs
Public bug reported: Binary package hint: checkinstall (Hardy, checkinstall version: 1.6.1-5ubuntu1) When using an option like --requires 'foo (>=1.0)' checkinstall interprets that parameter: --requires) shift REQUIRES=`eval echo $1` ;; Which leads to some warnings: /usr/bin/checkinstall: eval: line 494: syntax error near unexpected token `(' /usr/bin/checkinstall: eval: line 494: `echo foo (>=1.0)' I think that's not as it should be. One expects the given options to be used as provided and not to be interpreted. If I want to use a command's output I'd use --requires "$(somecommand)", not --requires \`somecommand\`. While looking around found another problem: function shell_escape() { for str in "$@" ; do echo -n "\"$str\" " done; echo } This interprets variables and other $... stuff in $str, if there is a " in $str, it gets even worse. It should for example be escaped with single quotes (and single quotes in the string replaced with '\'') ** Affects: checkinstall (Ubuntu) Importance: Undecided Status: New -- doesn't sanitize command line inputs https://bugs.launchpad.net/bugs/338956 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 338956] [NEW] doesn't sanitize command line inputs
Public bug reported: Binary package hint: checkinstall (Hardy, checkinstall version: 1.6.1-5ubuntu1) When using an option like --requires 'foo (>=1.0)' checkinstall interprets that parameter: --requires) shift REQUIRES=`eval echo $1` ;; Which leads to some warnings: /usr/bin/checkinstall: eval: line 494: syntax error near unexpected token `(' /usr/bin/checkinstall: eval: line 494: `echo foo (>=1.0)' I think that's not as it should be. One expects the given options to be used as provided and not to be interpreted. If I want to use a command's output I'd use --requires "$(somecommand)", not --requires \`somecommand\`. While looking around found another problem: function shell_escape() { for str in "$@" ; do echo -n "\"$str\" " done; echo } This interprets variables and other $... stuff in $str, if there is a " in $str, it gets even worse. It should for example be escaped with single quotes (and single quotes in the string replaced with '\'') ** Affects: checkinstall (Ubuntu) Importance: Undecided Status: New -- doesn't sanitize command line inputs https://bugs.launchpad.net/bugs/338956 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 338956] [NEW] doesn't sanitize command line inputs
Public bug reported: Binary package hint: checkinstall (Hardy, checkinstall version: 1.6.1-5ubuntu1) When using an option like --requires 'foo (>=1.0)' checkinstall interprets that parameter: --requires) shift REQUIRES=`eval echo $1` ;; Which leads to some warnings: /usr/bin/checkinstall: eval: line 494: syntax error near unexpected token `(' /usr/bin/checkinstall: eval: line 494: `echo foo (>=1.0)' I think that's not as it should be. One expects the given options to be used as provided and not to be interpreted. If I want to use a command's output I'd use --requires "$(somecommand)", not --requires \`somecommand\`. While looking around found another problem: function shell_escape() { for str in "$@" ; do echo -n "\"$str\" " done; echo } This interprets variables and other $... stuff in $str, if there is a " in $str, it gets even worse. It should for example be escaped with single quotes (and single quotes in the string replaced with '\'') ** Affects: checkinstall (Ubuntu) Importance: Undecided Status: New -- doesn't sanitize command line inputs https://bugs.launchpad.net/bugs/338956 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs