3 ms·
> I wonder what are the security implications of that. At least any terminal escape sequence can be executed if you run `file` on a JPEG, it seems, since this:
by deathanatos 10y ago
> I wonder what are the security implications of that.
At least any terminal escape sequence can be executed if you run `file` on a JPEG, it seems, since this:
curl -s 'http://www.imagemagick.org/image/fuzzy-magick.png' | convert - -set comment "$(printf 'asdf\x1b[1;31mTest?\x1b[0m hmm')" test2.jpg
file test2.jpg
Results in red text on my terminal for me.
(It also results in file writing a 0xff 0xdb to the terminal, which the terminal turns into the unicode fallback character since it's not valid text…)
- michaelmior 10y agoI just get the following so it seems like my version of file has been patched to handle this case. test2.jpg: JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, comment: "asdf\033[1;31mTest?\033[0m hmm", baseline, precision 8, 320x85, frames 3
- throwanem 10y agoSame here with file(1) version 5.22 from the Debian jessie package repo. I'd be interested to know in which versions this kind of thing actually works.
- cesarb 10y agoMy first guess would be "the MacOS one", since from what I have heard, MacOS tends to have older (sometimes much older) versions of basic system utilities. I don't have a MacOS machine nearby to check, so this is just a guess.
- kalleboo 10y agoWell that and they have BSD rather than GNU versions