Re: Shell wildcards considered dangerous?

[Leonid Isaev <leonid.isaev () ifax com>]

On Mon, Dec 09, 2019 at 04:28:35PM +0100, Noel Kuntze wrote:
> The message was about the attack vector on applications that put together
> argument vectors based on user input, not specifically about human use of the
> shell.

Then, why in "tar xf *.tar" the "*" is expected to mean anything other than
a literal * (0x2a)? It is because of the shell globbing: "tar xf ./*.tar" will
work without any "--". For example:
-----8<-----
$ echo -E "xxx" > "-b xxx.qwetr"
$ file *.qwetr
file: invalid option -- ' '
file: invalid option -- 'x'
file: invalid option -- 'x'
file: invalid option -- 'x'
file: invalid option -- '.'
file: invalid option -- 'q'
file: invalid option -- 'w'
Usage: file [-bcCdEhikLlNnprsvzZ0] [--apple] [--extension] [--mime-encoding]
            [--mime-type] [-e <testname>] [-F <separator>]  [-f <namefile>]
            [-m <magicfiles>] [-P <parameter=value>] <file> ...
       file -C [-m <magicfiles>]
       file [--help]
$
$ file ./*.qwetr
./-b xxx.qwetr: ASCII text
----->8-----

Sincerely,
L.