3 ms·
"This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedd
by mikece 5y ago
"This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names."
Perhaps I don't get this because I have used Windows most of my life (and DOS before that) but is it valid to have newline characters in a Unix/Linux filename?
- i80and 5y agoUnix filesystems can typically have filenames containing any bytes except "\0" and "/". I believe you can also have newline characters in NTFS, although Windows Explorer appears to prevent creating a file with them.
- mcculley 5y agoI have been using the filename "meeting-notes:10/1 \n Unix & Windows.txt" to test various apps. It tends to expose just how brittle modern computing still is.
- benibela 5y agoI made a whole collection: https://github.com/benibela/nasty-files https://github.com/benibela/nasty-files
- asddubs 5y ago"--no-preserve-root" made me laugh. for testing unescaped calls to rm?
- jamal-kumar 5y agoIt's a bypass against a mitigation for an old trick which worked back in the day where you could watch someone self-nuke themselves off of IRC by convincing them to type rm -rf /
- benibela 5y agoIt is to mess with people calling rm * / in the directory Good thing there is not really any reason to call rm like that
- asddubs 5y agooh does that actually work? the * expanding a filename to an argument? I guess it all just ends up in argv
- unqueued 5y agoOh cool! I use nasty-files as a submodule with some of my tests. I can't believe how long I went without without testing against the filename corner cases. I've found so much software that doesn't properly handle nasty filenames, I think it should be tested for more.
- PokestarFan 5y agoLol that broke git for me
- pixl97 5y agohttps://superuser.com/questions/129519/which-file-systems-support-newlines-in-file-names https://superuser.com/questions/129519/which-file-systems-su... So yea, it looks like that linux filesystems accept this, but a lot of utilities break.
- jeffbee 5y agoThere are no rules about what can be in a filename except they can't contain \0 or / as a matter of practice because the kernel interprets these as end of string and path element separator, respectively.
- johncolanduoni 5y agoFor even more fun NTFS filenames can actually have newlines in them if you access them with \\?\.
- jaclaz 5y agoGood to know. :) Another "queer" naming issue in Windows (JFYI), backslash and ALT+0160: https://msfn.org/board/topic/131103-win_nt~bt-can-be-omitted/?do=findComment&comment=842843 https://msfn.org/board/topic/131103-win_nt~bt-can-be-omitted...