Re: CVE-2014-6271: remote code execution through bash

[Michal Zalewski <lcamtuf () coredump cx>]

> STD::what::does::this::do

We ran into this problem with the original patch at Google, but TBH,
we've just bitten the bullet.

I'm not sure how hard we should try to accommodate outliers like this
specifically for functions - as far as I can tell, you can't really
get away with meaningfully using colons in variable names, right? But
if you just want to minimize breakage without getting into existential
discussions, wouldn't wihtelisting : and perhaps periods and - going
out on a limb - brackets be good enough?

/mz