Unix Wildcards Gone Wild

Re:Unix Wildcards Gone Wild by jingo on Sunday August 17, 2014 @06:41PM (#8190728)

   echo rm *

   echo chown -R nobody:nobody *.php

   echo chmod 000 *

   echo tar cvvf archive.tar *

   echo tar cf archive.tar *

   echo rsync -t *.c foo:src

This article starts with the premise that the person executing the command has no idea what files are in the current working directory. That is itself a more serious problem than the behaviour of wildcards.

Later in the article we learn that it also assumes GNU utilities. That is a second problem (IMO), and arguably also one more serious than the behaviour of wildcards. GNU userland and unneeded complexity (e.g. more features than any user will ever use) are practically synonymous.

Then there is the peculiar assumption that someone can place arbitrary files beginning with - or -- on this system. That itself is a far more serious problem than the behaviour of wildcards; I would say with that capability it is more or less "game over". In BSD you have, at the very least, mtree. How does the Linux user know she isn't executing some substituted executable?

Moreover, if caution was important to the hypothetical user in the examples, I think they would be in the form

   /path/to/program *

[ Parent | on HN ]

Re:Unix Wildcards Gone Wild by jordigh on Sunday August 17, 2014 @07:29PM (#8190832)

> GNU userland and unneeded complexity (e.g. more features than any user will ever use) are practically synonymous.

Ahhhh, the memories. These accusations bring me back to the early 1990's. Remember? Remember how it was? Oh, boy, how did we all get so old? To be young and running System V again...

And still today, whenever I'm faced on a system without GNU utilities, I find myself installing them to get what seems to me like basic functionality. We have never changed, have we?

[ Parent | on HN ]

Re:Unix Wildcards Gone Wild by jingo on Sunday August 17, 2014 @09:47PM (#8191132)

To be young and running VMS again...

[ Parent | on HN ]

Re:Unix Wildcards Gone Wild by eru on Sunday August 17, 2014 @09:58PM (#8191155)

> This article starts with the premise that the person executing the command has no idea what files are in the current working directory. That is itself a more serious problem than the behaviour of wildcards.

Substitute `person executing the command' with `simple script', and you've got a better justification. I don't want my simple scripts to break down in the face of silly filenames.

[ Parent | on HN ]

Re:Unix Wildcards Gone Wild by jingo on Monday August 18, 2014 @01:28AM (#8191526)

I keep forgetting that GNU echo has an -e option, which, if I'm not mistaken, makes it behave like printf. (Why does it need this feature when there also exists a builtin printf? Nevermind.)

Anyway, I didn't think about what happens if you create one file called "-e" and then do

    echo *

Anyway, as someone else pointed out, using ./* instead of * will defeat the "exploits" in the article.

[ Parent | on HN ]