[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] Add shell-quasiquote.
From: |
Michael Albinus |
Subject: |
Re: [PATCH] Add shell-quasiquote. |
Date: |
Sun, 18 Oct 2015 12:55:09 +0200 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/25.0.50 (gnu/linux) |
address@hidden (Taylan Ulrich "Bayırlı/Kammer") writes:
> Can a remote host arrange for TRAMP to use shell-quote-argument on
> arbitrary strings and pass these to a shell that could potentially be
> csh, or any shell we don't know shell-quote-argument to be safe for?
Tramp uses `shell-quote-argument' on strings it has been constructed
itself. But those strings contain file names Tramp has read on the
remote side. No check what's the contents of such file names.
There is no special check on a remote shell being csh. But most of the
shell commands Tramp emits require a bournish shell. Otherwise, there
would be syntax errors soon, and Tramp would cease to continue on that
host.
In theory, anything could go with unknown file name strings. But I'm not
aware how one could exploit it. If you could show me a real exploit, I
will react.
> Taylan
Best regards, Michael.
PS: I'm working as Security Consultant, and so I am paranoid per
definition. But I'm not *such* paranoid until I see there are good
reasons for.
- Re: [PATCH] Add shell-quasiquote., (continued)
- Re: [PATCH] Add shell-quasiquote., Eli Zaretskii, 2015/10/17
- Re: [PATCH] Add shell-quasiquote., Taylan Ulrich Bayırlı/Kammer, 2015/10/17
- Re: [PATCH] Add shell-quasiquote., Eli Zaretskii, 2015/10/17
- Re: [PATCH] Add shell-quasiquote., Taylan Ulrich Bayırlı/Kammer, 2015/10/17
- Re: [PATCH] Add shell-quasiquote., Dmitry Gutov, 2015/10/17
- Re: [PATCH] Add shell-quasiquote., Taylan Ulrich Bayırlı/Kammer, 2015/10/17
- Re: [PATCH] Add shell-quasiquote., Dmitry Gutov, 2015/10/17
- Re: [PATCH] Add shell-quasiquote., Taylan Ulrich Bayırlı/Kammer, 2015/10/17
- Re: [PATCH] Add shell-quasiquote., Michael Albinus, 2015/10/18
- Re: [PATCH] Add shell-quasiquote., Taylan Ulrich Bayırlı/Kammer, 2015/10/18
- Re: [PATCH] Add shell-quasiquote.,
Michael Albinus <=
- Re: [PATCH] Add shell-quasiquote., Random832, 2015/10/18
- Re: [PATCH] Add shell-quasiquote., Taylan Ulrich Bayırlı/Kammer, 2015/10/18
- Re: [PATCH] Add shell-quasiquote., Michael Albinus, 2015/10/18
- Re: [PATCH] Add shell-quasiquote., Eli Zaretskii, 2015/10/18
- Re: [PATCH] Add shell-quasiquote., Random832, 2015/10/18
- Re: [PATCH] Add shell-quasiquote., Eli Zaretskii, 2015/10/18
- Re: [PATCH] Add shell-quasiquote., Stephen J. Turnbull, 2015/10/19
- Re: [PATCH] Add shell-quasiquote., Eli Zaretskii, 2015/10/19
- Re: [PATCH] Add shell-quasiquote., Daniel Colascione, 2015/10/19
- Re: [PATCH] Add shell-quasiquote., Eli Zaretskii, 2015/10/19