5 ms·
Sounds neat. However, the fact that `ls -l` either subtracts two numbers or calls a shell command, depending on whether there exist valriables 'ls' and 'l' in t
by ilyagr 8y ago
Sounds neat. However, the fact that `ls -l` either subtracts two numbers or calls a shell command, depending on whether there exist valriables 'ls' and 'l' in the Pythom environment, looks like a security nightmare waiting to happen. What if I create a python object 'ls' deep inside a script that does Evil when subtracted from?
- scopatz 8y agoPython variables are scoped as normal, so the security story for xonsh is the same as for Python. We are always open to suggestions and PRs to harden the code base as needed.
- bitwize 8y agoIt could be worse. It could be a Wolfram shell, in which case 'ls -l' would return 'l(s - 1)'.
- Norther 8y agoWhat's stopping a Bash script from doing something similar? You could alias ls to a malicious actor for example.
- kbd 8y agoWell, aliases are ignored in scripts usually, but you could prepend something to the PATH so your script/exe gets found before built-ins, no? I agree, I don't see that this is a problem unique to Xonsh.
- djsumdog 8y agoI mean, that's the underlying concept behind the fork bomb isn't it? With ":() { :|:&}" you're essentially redefining the bash noop to be a function that pipes/forks itself into itself recursively. It's the reason './' is not in the default path as well (so you can't place an 'ls' in your home directory and have the admin run your command instead of the real ls).
- m45t3r 8y agoYou
- daveFNbuck 8y agoWhy not just do the evil directly in the script if you can do that?