Article View: comp.unix.shell
Article #1660Re: Beware xargs security holes
From: Dan Bernstein
Date: Mon, 29 Oct 1990 22:24
Date: Mon, 29 Oct 1990 22:24
17 lines
1162 bytes
1162 bytes
In article <john.657158675@troch> john@sco.COM (John R. MacMillan) writes: > |find / -name '#*' -print | egrep -v '.*/#[^/]*' | xargs rm -f -- No! Think about links. > So now that we can all safely and automatically remove files I think > we should kill this thread before I embarass myself further. Perhaps people should think about their supposed solutions before posting them. Not to flame, but you're the eighth person to post an insecure pipeline in this thread. Folks, just don't use find | xargs as root until it has -0 to parse nulls and find has -print0 to match. You'll sleep better at night using -exec rm than somebody's supposedly secure pipeline from hell. ---Dan
Technical Details
Message-ID:
<13090:Oct2922:24:5990@kramden.acf.nyu.edu>Path:
arc1-ca.pugleaf.net!utzoo!utgpu!cs.utexas.edu!sdd.hp.com!wuarchive!udel!haven!adm!cmcl2!kramden.acf.nyu.edu!brnstndReferences:
<john.656921455@troch> <649@inews.intel.com> <john.657158675@troch>Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!utgpu!cs.utexas.edu!sdd.hp.com!wuarchive!udel!haven!adm!cmcl2!kramden.acf.nyu.edu!brnstnd From: brnstnd@kramden.acf.nyu.edu (Dan Bernstein) Newsgroups: comp.unix.shell,alt.security Subject: Re: Beware xargs security holes Summary: do not do this Message-ID: <13090:Oct2922:24:5990@kramden.acf.nyu.edu> Date: 29 Oct 90 22:24:59 GMT References: <john.656921455@troch> <649@inews.intel.com> <john.657158675@troch> Organization: IR Lines: 17