Re: CVE request: ruby file creation due in insertion of illegal NUL character

[Simon McVittie <smcv () debian org>]

On 17/10/12 18:03, Kurt Seifried wrote:
> Avtually looking at that page it appears that no modern file 
> systems allows NUL in a file name (and in general I suspect it's a
> bad idea/leads to some nasty edge case issues).

Anything that, directly or indirectly, uses Unix-style APIs to access
files can't possibly support NUL in a filename anyway, since those
APIs receive the filename as a NUL-terminated string.

> Personally I think the perlopentut case makes sense, using NUL as
> an end of string marker. What happens if stuff comes after it
> though?

For Perl, one possibility would be to continue to treat an input of
"foo\0" as equivalent to "foo" (so that you can use "./ foo \0" to
mean " foo ", as documented), but disallow NULs anywhere except the
last position.

    S