4 ms·
But you have already acknowledged the fundamental problem with using --, namely, that you cannot count on it always working. If you can't count on something, th
by dwheeler 8y ago
But you have already acknowledged the fundamental problem with using --, namely, that you cannot count on it always working. If you can't count on something, then that is not something you should be relying on. Clearly it is possible to do a lookup on every single command you ever use, but most people will not. Prepending "./" always works, no exceptions.
I completely agree that validating input is very important. Indeed, I am recommending that the kernel do input validation on file names.
- anyfoo 8y agoIt's important to validate input at the right level, otherwise you get attempts like PHP's "magic quotes" that appear to solve the problem superficially, but don't. I agree with others at this thread here: Each program that your program passes a filename to needs to be considered and handled individually. You cannot rely on "./" being a general solution. What if the program matches the given path against other paths, and does so verbatim without normalization? What if you're explicitly supposed to pass a filename, not a path? In the first case, maybe you claim that the program misbehaves, but one could argue that not having something like "--" is also misbehavior, and in any case, you have to handle it. Again: Thinking that there is a universal solution, like "./", for a problem that in reality is about inconsistent interfaces and therefore requires you to look at each interface individually will get you into hot waters.