Article View: comp.unix.shell
Article #1626Re: Beware xargs security holes
From: 2656-Daniel R. Levy(0000000)0000
Date: Mon, 29 Oct 1990 05:58
Date: Mon, 29 Oct 1990 05:58
20 lines
1719 bytes
1719 bytes
>>But it's still susceptible to filenames with carriage returns, and will >>be until find has a -print0 option. Please, please, please don't claim >>that your xargs is by any means secure when a standard command like >> >> find / -name '#*' -atime +7 -print | xargs rm >> >>lets a malicious user remove every file on the system. Maybe it's >>unreasonable of me to want others to live up to my standard of security, >>but in my eyes no \n-parsing xargs qualifies as ``a good job.'' Sorry. For a brief moment there I thought one could do an end run by telling find not to match files whose names contain newline (e.g. ! -name '*^J*' where ^J is an actual newline character). But alas, that does not exclude files within directories whose names (the directories' that is) contain newlines. Oh well. -- * Daniel R. Levy * uunet!tellab5!mtcchi!levy * | * These views are live; they are not Memorex' * --+-- "Because we love something else more than this world we love even | this world better than those who know no other" -- C. S. Lewis |
Technical Details
Message-ID:
<1990Oct29.055826.3814@mtcchi.uucp>Path:
arc1-ca.pugleaf.net!utzoo!attcan!uunet!nih-csl!lhc!ncifcrf!haven!udel!wuarchive!zaphod.mps.ohio-state.edu!mips!pacbell.com!att!att!mcdchg!tellab5!mtcchi!levyReferences:
<63404@iuvax.cs.indiana.edu> <1990Oct9.172621.13484@cbnews.att.com> <271653D6.1CE8@tct.uucp> <4062:Oct1518:22:1290@kramden.acf.nyu.edu> <3186@unisoft.UUCP>Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!attcan!uunet!nih-csl!lhc!ncifcrf!haven!udel!wuarchive!zaphod.mps.ohio-state.edu!mips!pacbell.com!att!att!mcdchg!tellab5!mtcchi!levy From: levy@mtcchi.uucp (2656-Daniel R. Levy(0000000)0000) Newsgroups: comp.unix.shell,comp.lang.perl Subject: Re: Beware xargs security holes Message-ID: <1990Oct29.055826.3814@mtcchi.uucp> Date: 29 Oct 90 05:58:26 GMT References: <63404@iuvax.cs.indiana.edu> <1990Oct9.172621.13484@cbnews.att.com> <271653D6.1CE8@tct.uucp> <4062:Oct1518:22:1290@kramden.acf.nyu.edu> <3186@unisoft.UUCP> Organization: Memorex Telex Corporation NSBG/STP Lines: 20