Re: bash - safely pass untrusted strings?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]



On Tuesday 26 February 2008, Ralph Angenendt wrote:
> > There is no mechanism for escaping untrusted input?
> 
> Correct. At least there's no magic quoting function.

Ok. So I'm going to have to pull up my sleeves and do this with sed/awk pipes. 
Got it. I'll quit looking for a simply solution to this (I thought) simple 
problem.

Now for a more philosophical question....

WHY THE @!#! NOT?!?!?

Bash is used, extensively in many cases, to deal with untrusted data. This can 
include random file names in user home directories, parameters on various 
scripts, etc. It's highly sensitive to being passed characters that have, 
over the past NN years, resulted in quite a number of security holes and 
problems. 

Yet there exists NO MECHANISM for simply ensuring that a given argument is an 
escaped string? 

How many "homebrew" ISP or hosting administration scripts could be compromised 
by simply putting a file in your home directory called ";rm -rf /" ? 

This doesn't strike you as fundamentally borkeD? Why would we accept a work 
environment that is effectively laden with randomly placed, loaded rat traps? 
Not trying to bash (ahem) bash needlessly, but this is a problem that so 
smacks of 1977... 

I guess I just hadn't noticed how bad this was, since I started using PHP as 
shell scripts years ago to run everything, despite the mild performance hit. 
escapeshallarg() and addslashes() combined with a few backticks provides easy 
access to the power of the shell, and excellent "don't need to worry about 
it" security. 

This just blows my mind....

-Ben 
--
Only those who reach toward a goal are likely to achieve it. 

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos

[Index of Archives]     [CentOS]     [CentOS Announce]     [CentOS Development]     [CentOS ARM Devel]     [CentOS Docs]     [CentOS Virtualization]     [Carrier Grade Linux]     [Linux Media]     [Asterisk]     [DCCP]     [Netdev]     [Xorg]     [Linux USB]
  Powered by Linux