dash/ash
dash/ash
Posted Oct 2, 2014 21:25 UTC (Thu) by flussence (guest, #85566)In reply to: dash/ash by ibukanov
Parent article: Bash gets shellshocked
It's had that feature for decades: 2-arg open() will happily interpret any filename passed to it containing a "|" prefix or suffix to mean a command pipe, and helpfully give the rest of the string to the shell to run. The same function is also used internally to pass filenames in ARGV into the magic <> line-iterator.
Posted Oct 3, 2014 11:23 UTC (Fri)
by dskoll (subscriber, #1630)
[Link]
2-arg open() will happily interpret any filename passed to it containing a "|" prefix or suffix
That's a little different from the bash bug. It requires the programmer to write a script that doesn't handle user-input safely. It's also stopped in taint mode.
The Bash bug doesn't require any action on the part of the script writer; it happens before your script even has a chance to do anything.
dash/ash