oss-sec mailing list archives
Re: Thoughts on Shellshock and beyond
From: Florian Weimer <fweimer () redhat com>
Date: Fri, 10 Oct 2014 10:39:54 +0200
On 10/09/2014 10:56 PM, Pavel Labushev wrote:
On Thu, 09 Oct 2014 15:00:04 -0400 (EDT) "David A. Wheeler" <dwheeler () dwheeler com> wrote:On Thu, 9 Oct 2014 10:34:49 -0700, Tracy Reed <treed () ultraviolet org> wrote:Sure, but at least with Haskell (and the like) you have to make it very explicit that this is what you want to do.Not in this case. A Haskell implementation of the POSIX "sh" specification, that then added function imports, could have made the same mistake just as easily.Just as easily? Might be, but that's a totally unjustified conclusion.
You need to put labels on shell variables. The SELinux folks did not do it, but maybe they considered it. It seems unlikely that a shell rewrite came up with this concept on its own. None of the Bourne-like shells we have implement anything like that, after all.
Not using a parser generator, but a manually written recursive descent parser might have helped because you could have called the function corresponding to the function definition production directly. (However, there would still have been parser exposure to the network.)
First of all, *if* a programmer wants to express higher level concepts (such as "untrusted data" and how it may and may not be manipulated) in languages like Haskell, he doesn't resort to some sort of manual labour of maintaining a masochistic discipline of performing tedious repetitive tasks in the context of ubiquitous uncertainty and fuzzy reasoning, no. He expresses himself in a much more concise and abstract way, and places much of the burden of reasoning and proving on the machine.
The Haskell standard library does not even distinguish between a read error and an end-of-stream condition. You can't build reliable software on top of that.
Some of the incomplete state reset issues might have been more obvious with Haskell (but you can easily thread a state variable incorrectly, in effect discarding intended updates). But in any language, not using global variables for parser state (and building the state from scratch each time before calling the parser) would avoid those in a fairly reliable way.
-- Florian Weimer / Red Hat Product Security
Current thread:
- Re: Re: Thoughts on Shellshock and beyond, (continued)
- Re: Re: Thoughts on Shellshock and beyond Michal Zalewski (Oct 08)
- Re: Thoughts on Shellshock and beyond Tim (Oct 08)
- Re: Thoughts on Shellshock and beyond Michal Zalewski (Oct 08)
- Re: Thoughts on Shellshock and beyond David A. Wheeler (Oct 08)
- Re: Thoughts on Shellshock and beyond Tracy Reed (Oct 08)
- Re: Thoughts on Shellshock and beyond Tim (Oct 08)
- Re: Thoughts on Shellshock and beyond David A. Wheeler (Oct 08)
- Re: Thoughts on Shellshock and beyond Tracy Reed (Oct 09)
- Re: Thoughts on Shellshock and beyond David A. Wheeler (Oct 09)
- Re: Thoughts on Shellshock and beyond Pavel Labushev (Oct 09)
- Message not available
- Re: Thoughts on Shellshock and beyond Florian Weimer (Oct 10)
- Re: Thoughts on Shellshock and beyond Pavel Labushev (Oct 11)
- Message not available
- Re: Thoughts on Shellshock and beyond Florian Weimer (Oct 12)
- Re: Thoughts on Shellshock and beyond John Haxby (Oct 12)
- Re: Thoughts on Shellshock and beyond Pavel Labushev (Oct 14)
- Re: Thoughts on Shellshock and beyond Sven Kieske (Oct 09)
- Re: Thoughts on Shellshock and beyond Michal Zalewski (Oct 09)
- Re: Thoughts on Shellshock and beyond Sven Kieske (Oct 09)
- liability (was: Re: Thoughts on Shellshock and beyond) Solar Designer (Oct 09)
- Re: liability dmc (Oct 09)
- Re: liability (was: Re: Thoughts on Shellshock and beyond) Źmicier Januszkiewicz (Oct 10)