Re: Shell wildcards considered dangerous?

[Noel Kuntze <noel.kuntze+oss-security@thermi.consulting>]

Hello Leonid,

The message was about the attack vector on applications that put together argument vectors
based on user input, not specifically about human use of the shell.

The same problem applies to that though. Users need to use -- to terminate the option list.

Kind regards

Noel

Am 09.12.19 um 16:18 schrieb Leonid Isaev:
> On Mon, Dec 09, 2019 at 03:42:47PM +0100, Noel Kuntze wrote:
> > That is only a problem if the developer(s) foolishly didn't use "--" to
> > terminate the command line options or they did, but the argument parser of
> > the called program does not understand that "--" is a command line option
> > terminator.
> I'm sorry, but this has nothing to do with developers of PROGRAM to use or not
> user "--", but rather with the user not properly sanitizing the input to the
> PROGRAM and not understanding how shell works. Specifically, doing
> PROGRAM *.tar is just asking for trouble for many reasons, not mentioned in the
> original email. See [1] (and in general BashPitfalls) for a proper discussion...
>
> HTH,
> L.
>
> [1] https://mywiki.wooledge.org/BashPitfalls#for_f_in_.24.28ls_.2A.mp3.29

-- 
Noel Kuntze
IT security consultant

GPG Key ID: 0x0739AD6C
Fingerprint: 3524 93BE B5F7 8E63 1372 AF2D F54E E40B 0739 AD6C