Comment 18 for bug 27767

Revision history for this message
In , Martin Schulze (joey-infodrom) wrote : Re: Bug#345238: Shell command injection in delegate code (via file names)

Daniel Kobras wrote:
> On Fri, Jan 27, 2006 at 10:59:34PM +0100, Martin Schulze wrote:
> > Daniel Kobras wrote:
> > > > Gnah. You are correct. I'm extending the list of forbidden characters
> > > > by $().
> > >
> > > Upstream has reverted the blacklist and instead went for an improved
> > > version of the symlink fix I added to ImageMagick in unstable. The patch
> > > is more involved, but also more robust and doesn't impose limits on
> > > allowed filenames. If you're interested I can extract the changes from
> > > upstream SVN.
> >
> > I've sen your patch and decided against it since it is quite intrusive.
> > The blacklist approach should be sufficient for the updates in our stable
> > releases.
>
> Yes, but then '(' and ')' are quite commonly found in filenames, so
> someone might trip over this change. The previous fix for CAN-2005-0397

I've decided that they're not dangerous on their own, but only the $
sign, so the patch doesn't touch () at all.

Regards,

 Joey

--
Computers are not intelligent. They only think they are.

Please always Cc to me when replying to me on the lists.