3 ms·
Never pipe `find` to `xargs rm -f`. All you need is a malicious empty file called / and you're screwed. That's why `find` has a -delete flag.
by botker 15y ago
Never pipe `find` to `xargs rm -f`. All you need is a malicious empty file called / and you're screwed. That's why `find` has a -delete flag.
- tszming 15y agoA forward slash is not a valid file name.
- Jach 15y agoThe chances of such a file coming into existence accidentally and also being picked up in the find filter seem slim. If it's around maliciously, I think you have bigger problems. Anyway, there are many other failure modes of rm -rf that are a lot more likely and you should worry about.
- moe 15y agoThe chances of such a file coming into existence accidentally When sharing servers with less UNIX savvy developers you will observe A) a notoriously polluted home-directory and B) plenty of files with funny names such as -, * , user@server.com (from failed scp attempts) all over the place. It's indeed relatively hard to create a file called '/' by accident. But I've seen files containing the '/' along with spaces, which can be just as deadly. Oh and the popular * -file is not to be taken lightly either. As a rule of thumb: Learn the safe way to chain these commands (find/xargs in particular) once and stick to it. And always perform a dry-run before launching the real deal.
- koenigdavidmj 15y agoUnix filenames can not include / characters or null bytes, so I call shenanigans. Nonetheless your point stands: be careful. (And make liberal use of -print0 !)
- moe 15y agoSeems you are right! I could've sworn I've seen them before, guess my memory got mixed up there.
- ori_b 15y ago'/' is an illegal character in filenames. Such a file is impossible on a unix system.