Re: [bug-gawk] Bug in sandbox mode?

[Manuel Collado]

El 16/06/2011 21:11, Aharon Robbins escribió:
> Hi.
>
> In article<address@hidden>,
> Edward Rosten<address@hidden>  wrote:
> ...
> > I think I've found a bug in the sandbox mode:
> >
> > ./gawk --sandbox 'BEGIN{ARGV[1]="/etc/passwd"}1' /dev/null
> >
> > shows the contents of /etc/passwd.
>
> Why is this a bug?  I bet that cat /etc/passwd shows the contents
> of the file as well. Sandbox mode prevents *writing* files, not reading them.

Well, the info manual says:

`--sandbox'
     Disable the `system()' function, input redirections with `getline',
     output redirections with `print' and `printf', and dynamic
     extensions.  This is particularly useful when you want to run
     `awk' scripts from questionable sources and need to make sure the
     scripts can't access your system (other than the specified input
     data file).

IMHO, disabling getline redirection only makes sense if you want to 
prevent *reading* system files from dubious scripts, right?

So perhaps the reported behavior can be seen as a bug, because it is a 
workaround for some of the intended --sandbox restrictions.

Kind regards,
--
Manuel Collado - http://lml.ls.fi.upm.es/~mcollado