4 ms·

Even Linux tools like GNOME Archive Manager in Linux Mint 18 rejected my RAR password containing a $ as the incorrect password, even though it was the correct p

Even Linux tools like GNOME Archive Manager in Linux Mint 18 rejected my RAR password containing a $ as the incorrect password, even though it was the correct password for the RAR file I was trying to extract. I then used the command-line unrar utility with the exact same password, and it extracted successfully. Now, why would you preemptively (and explicitly) throw out a candidate password string based on its characters? At least make the validation consistent. I also had trouble with connecting to a wifi network with a WPA password containing an ampersand in Arch Linux using the Arch Wiki's recommended command line network manager utility (netctl, if my memory serves me correctly), and I tried all sorts of ways of escaping it and quoting it in the configuration file. The Arch devs on IRC just told me to change my AP settings so that the wifi network doesn't use a password containing an ampersand character. Well, that would have been a good idea, but it wasn't my network, so I didn't have the ability to change its WPA password.

flukus 10y ago
I'm guessing both are because the are calling command line tools. One of my pet peeves with linux is that many of these tools are only callable via text and don't expose an API for other programs.
- zAy0LfpBZLC8mAC 10y ago
  "callable via text"? What does that even mean? The command line is an API, isn't it? If people don't manage to pass an ampersand to another program via the command line, that's really no different than people failing to pass an ampersand as a URI parameter to an HTTP resource: Failure to encode properly. There is absolutely nothing that prevents you from passing an ampersand (or any other characters) to a program via its command line.
  - flukus 10y ago
    > "callable via text"? What does that even mean? It means you have to execute commands through a shell. A real API would be something you could include in your program, execute a method against and get a list of objects back. Instead all these basic command are replicated in every framework. As far as encoding properly, you're preaching to the choir, but out in the real world there is still injection attacks everywhere.
    - zAy0LfpBZLC8mAC 10y ago
      > It means you have to execute commands through a shell. Except you don't. There is no need to involve a shell. > A real API would be something you could include in your program, execute a method against and get a list of objects back. So, Web APIs are not APIs? Also, you can execute methods against command line programs, method names usually start with a dash.
- kalleboo 10y ago
  But even PHP has a way to escape shell arguments safely
  - flukus 10y ago
    Having a way and being used everywhere are different things. That's why we still have sql injection attacks.
- Filligree 10y ago
  Word-splitting, escape character interpretation and so forth is done by the shell. The shell is only invoked if you use the system() call to run said tool. Which you shouldn't. execve (and friends) will let you pass an explicit array of flags, and you should always use one of those functions if you're calling another program. No interpretation.
- int_19h 10y ago
  On a Unix system, a console application is effectively just a vararg function taking a bunch of const char* arguments. There's no limitation on what characters you can pass as those arguments, so that doesn't sound like a valid excuse. (There are some characters that are treated specially by shells, and require escaping - but you don't normally spawn child processes via a shell.)

flukus 10y ago

I'm guessing both are because the are calling command line tools. One of my pet peeves with linux is that many of these tools are only callable via text and don't expose an API for other programs.

zAy0LfpBZLC8mAC 10y ago
"callable via text"? What does that even mean? The command line is an API, isn't it? If people don't manage to pass an ampersand to another program via the command line, that's really no different than people failing to pass an ampersand as a URI parameter to an HTTP resource: Failure to encode properly. There is absolutely nothing that prevents you from passing an ampersand (or any other characters) to a program via its command line.
- flukus 10y ago
  > "callable via text"? What does that even mean? It means you have to execute commands through a shell. A real API would be something you could include in your program, execute a method against and get a list of objects back. Instead all these basic command are replicated in every framework. As far as encoding properly, you're preaching to the choir, but out in the real world there is still injection attacks everywhere.
  - zAy0LfpBZLC8mAC 10y ago
    > It means you have to execute commands through a shell. Except you don't. There is no need to involve a shell. > A real API would be something you could include in your program, execute a method against and get a list of objects back. So, Web APIs are not APIs? Also, you can execute methods against command line programs, method names usually start with a dash.
kalleboo 10y ago
But even PHP has a way to escape shell arguments safely
- flukus 10y ago
  Having a way and being used everywhere are different things. That's why we still have sql injection attacks.
Filligree 10y ago
Word-splitting, escape character interpretation and so forth is done by the shell. The shell is only invoked if you use the system() call to run said tool. Which you shouldn't. execve (and friends) will let you pass an explicit array of flags, and you should always use one of those functions if you're calling another program. No interpretation.
int_19h 10y ago
On a Unix system, a console application is effectively just a vararg function taking a bunch of const char* arguments. There's no limitation on what characters you can pass as those arguments, so that doesn't sound like a valid excuse. (There are some characters that are treated specially by shells, and require escaping - but you don't normally spawn child processes via a shell.)