4 ms·
The first time I accidentally ran "less" on a directory and it piped some version of "ls" into itself, I was mildly annoyed. The thing's supposed to page a tex
by username223 12y ago
The first time I accidentally ran "less" on a directory and it piped some version of "ls" into itself, I was mildly annoyed. The thing's supposed to page a text file on a terminal. Since then, I've had to think twice before invoking it to avoid this "helpful" behavior, and I'm not surprised that it came back to bite people.
- userbinator 12y agoI suppose this would be the more straightforward and expected behaviour: less: somedir: is a directory
- cbd1984 12y ago> The first time I accidentally ran "less" on a directory and it piped some version of "ls" into itself, I was mildly annoyed. % less . . is a directory % less imadir imadir is a directory My point is, that behavior is a configuration issue on your end, not inherent to the less codebase.
- naner 12y agoI believe that is the point of the linked email. Some distributions have less symlinked to something else (e.g. the lesspipe script) for convenience. Plain 'ol less isn't that much of a problem.
- username223 12y ago> My point is, that behavior is a configuration issue on your end, ... On my end, and on every "end" where I ever log in. "less" works as a simple pager on my own system, but now I need to remember to possibly fix it everywhere else. "You can fix it in the config file" is not an excuse for broken-by-design software. > ... not inherent to the less codebase. Well yes, it kind of is. "less" used to be a better replacement for "more." Now it's something else, which should have a different name. Should "cat" be changed to automatically uncompress files and concatenate archives?
- lmm 12y ago> Well yes, it kind of is. "less" used to be a better replacement for "more." Now it's something else, which should have a different name. Should "cat" be changed to automatically uncompress files and concatenate archives? "less" already means "pager with all the bells and whistles". If you just want a simple pager, "more" is still there. How many fine gradations do you need?
- ansible 12y agoBack in the old, old days, we all started using 'less' because 'more' did not have the ability to scroll backwards through a file. Nor was it buffering pipe input to enable similar functionality. It seems there has been a bit of feature creep in the ensuing 25 years...
- oftenwrong 12y agoYou could replace your less with the busybox version of less, which does not support LESSOPEN.
- dllthomas 12y agoMy understanding is that the less codebase has the hooks (LESSOPEN and LESSCLOSE), and it's configurable (by presence or absence of the variables) whether they're used.
- raverbashing 12y agoWe need a less that does less than less today but more than more This reminds me of an old program called list.com that could open anything as a text file. Any size whatsoever, any line size, etc.
- ars 12y agoYou may also want to try the 'most' command, which is like less but more advanced.
- lmm 12y agoMore advanced is exactly the problem here. If you use a simpler program like 'more' or 'pg', you won't have these kinds of vulnerabilities.
- ars 12y agoThe vulnerability is not actually in the less command. Did you overlook that? Using a simpler program is useless when that's not the problem in the first place. Using more instead gains you nothing except a less useful program.
- lmm 12y agoThe vulnerability is in less-the-complete-system. More doesn't even have the ability to pipe its input through random shell scripts that call exploitable programs, AFAIK. The problem is parsing complex file formats in unsafe programming languages, and any system which does that will be vulnerable.