From: Stefan Kangas <stefankangas@gmail.com>
To: Eli Zaretskii <eliz@gnu.org>, lux <lx@shellcodes.org>
Cc: 59817@debbugs.gnu.org
Subject: bug#59817: [PATCH] Fix etags local command injection vulnerability
Date: Sun, 4 Dec 2022 08:27:14 -0800 [thread overview]
Message-ID: <CADwFkmmGvC_Q+e=FFRN1jBtOycLs0iXO3KanU8fTBwpff0WJJw@mail.gmail.com> (raw)
In-Reply-To: <83r0xf9qsx.fsf@gnu.org>
Eli Zaretskii <eliz@gnu.org> writes:
> Thanks, but no, thanks. This cure is worse than the disease. Let's please
> find simpler, more robust solutions. It TMPDIR is a problem, let's use a
> file whose name is hard-coded in the etags.c source, or quote the name when
> we pass it to the shell. If we suspect someone could disguise shell
> commands as file names, let's quote the file names we pass to the shell with
> '...' to prevent that. Etc. etc. -- let's use simple solutions that don't
> drastically change the code.
With single quotes, every single quote character also needs to be quoted
so you can't just use a file named "';rm -rf $HOME;'".
So you need to substitute every single quote character with something like
' => '"'"'
I'm not sure if tricks to escape it will remain, but "man sh" promises:
Single Quotes
Enclosing characters in single quotes preserves the literal meaning
of all the characters (except single quotes, making it impossible
to put single-quotes in a single-quoted string).
The safest option is to just not call system, of course.
next prev parent reply other threads:[~2022-12-04 16:27 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-04 13:51 bug#59817: [PATCH] Fix etags local command injection vulnerability lux
2022-12-04 14:39 ` Eli Zaretskii
2022-12-04 16:27 ` Stefan Kangas [this message]
2022-12-04 17:04 ` Eli Zaretskii
[not found] ` <tencent_2F6B5EEED2E485C363837738F5661E6AB009@qq.com>
2022-12-05 12:34 ` Eli Zaretskii
2022-12-06 7:48 ` lux
2022-12-06 12:55 ` Eli Zaretskii
2022-12-06 13:11 ` lux
2022-12-06 14:52 ` Eli Zaretskii
2022-12-06 15:05 ` Francesco Potortì
2022-12-06 15:19 ` Francesco Potortì
2022-12-06 15:49 ` lux
2022-12-06 16:14 ` Eli Zaretskii
2022-12-06 13:05 ` Andreas Schwab
2022-12-06 14:33 ` Eli Zaretskii
2022-12-05 0:58 ` lux
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CADwFkmmGvC_Q+e=FFRN1jBtOycLs0iXO3KanU8fTBwpff0WJJw@mail.gmail.com' \
--to=stefankangas@gmail.com \
--cc=59817@debbugs.gnu.org \
--cc=eliz@gnu.org \
--cc=lx@shellcodes.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.