4 ms·
i think more bugs reside here. if tarball or path is user input then they could be used to inject tar command options.
by thirdplace_ 3y ago
i think more bugs reside here.
if tarball or path is user input then they could be used to inject tar command options.
- Smaug123 3y agoThat, however, is an extremely well-known class of bug. The post is about an extremely obscure (but presumably quite common at the time!) class of bug.
- carlmr 3y agoAlso, if you're writing about bug x, you might make a minimal reconstruction of that piece of code only to showcase bug x, instead of the full version with all bells and whistles.
- karatinversion 3y agotarball is the mandatory parameter to the preceding -f and can’t be used to inject commands
- ndsipa_pomu 3y agoThat's usually prevented by using double dashes ("--") to indicate the end of options, before the file argument. I try to remember to include include double dashes in my shell scripts for as many commands as possible (it's easier to just include them rather than figure out whether a user could possible influence the filename).
- deleted 3y ago[deleted]