[bug #18576] -execdir vs. PATH

[James Youngman]

Update of bug #18576 (project findutils):

                Severity:              3 - Normal => 1 - Wish               
                  Status:                    None => Wont Fix               

    _______________________________________________________

Follow-up Comment #9:

After a bit of thought I've decided to leave the functionality as it is, for
a number of reasons, none of which is by itself very influential:

1. It's fairly easy to work around the current situation if you don't like it
(e.g. by unsetting PATH).

2. Relative directories on the path are almost always a bad idea, so I'm not
very persuaded by considerations of making life easier for those with that
misconfiguration.

3. The proposed compromise adds complexity to the code and to the
documentation.  

4. If find suspects but cannot prove that a relative path search will occur,
it can't be certain whether or not something dangerous is going to happen. 
If the situation is uncertain I'd prefer to live with a cautious but somewhat
irritating choice rather than a convenient but potentially insecure one.

So, while I stated "I agree" on 22 Dec, I changed my mind on the 29th.  I
have changed the findutils code in response to this bug report, but not in
the way that Eric really wanted, I think.  So it would be a bit disingenuous
to mark the bug as "Fixed".  Instead I will mark it as "Won't Fix".

If you feel strongly about this, I would be prepared to apply a patch which
allowed the behaviour you prefer to be enabled with some --enable-foo
configure option.  If you do decide to go down that route, please be careful
to keep the number of alternative code paths down (in order to ensure that
the relevant code gets routinely tested and doesn't end up with a bug nobody
notices for ages).



    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/bugs/?18576>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/