TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Unix Wildcards Gone Wild (2014)

92 点作者 veganjay将近 7 年前

6 条评论

okdana将近 7 年前
&gt;Simple trick behind this technique is that when using shell wildcards, especially asterisk (...), Unix shell will interpret files beginning with hyphen (-) character as command line arguments to executed command&#x2F;program.<p>To be clear, the shell isn&#x27;t really &#x27;interpreting&#x27; anything here — it knows absolutely nothing about the argument conventions of whatever program you&#x27;re running[0]. All it&#x27;s doing is passing a list of arguments to an executable; how the executable deals with that is up to it.<p>And this isn&#x27;t only a shell problem — it&#x27;s an issue when you pass arbitrary arguments to ANY external utility in ANY language. For example, maybe you have some kind of tool that calls grep:<p><pre><code> # Perl exec &#x27;&#x2F;usr&#x2F;bin&#x2F;grep&#x27;, &#x27;-R&#x27;, $input, &#x27;mydir&#x27;; # PHP (with Symfony Process) (new Process([&#x27;&#x2F;usr&#x2F;bin&#x2F;grep&#x27;, &#x27;-R&#x27;, $input, &#x27;mydir&#x27;]))-&gt;run(); # Python subprocess.run([&#x27;&#x2F;usr&#x2F;bin&#x2F;grep&#x27;, &#x27;-R&#x27;, input, &#x27;mydir&#x27;]) # C execv(&quot;&#x2F;usr&#x2F;bin&#x2F;grep&quot;, (char *[]) {&quot;grep&quot;, &quot;-R&quot;, input, &quot;mydir&quot;, NULL}); </code></pre> All of these are safe in the sense that there&#x27;s no risk of shell command injection (in fact, only the PHP one even calls the shell), but NONE of them are safe against this problem, where the input value might begin with a hyphen. In this grep scenario it&#x27;s probably not a security issue, but it can produce confusing results for the user if nothing else.<p>As others mentioned, you must ALWAYS use &#x27;--&#x27; to mark the end of option processing when you do something like this.<p>[0] Technically the shell knows about the conventions of its built-ins, but even those mostly handle arguments in a similar fashion to external utilities, where an arbitrary argv is fed to a function and then parsed using some getopts-like method.
评论 #17378675 未加载
评论 #17379729 未加载
评论 #17381405 未加载
评论 #17380464 未加载
Pete_D将近 7 年前
I didn&#x27;t see this mentioned in the article, but you can protect against this in your own scripts by including a -- before user-supplied parameters, which prevents them from being treated as flags.<p><pre><code> $ rm -- -rf rm: cannot remove &#x27;-rf&#x27;: No such file or directory </code></pre> (see Guideline 10, <a href="http:&#x2F;&#x2F;pubs.opengroup.org&#x2F;onlinepubs&#x2F;009695399&#x2F;basedefs&#x2F;xbd_chap12.html#tag_12_02" rel="nofollow">http:&#x2F;&#x2F;pubs.opengroup.org&#x2F;onlinepubs&#x2F;009695399&#x2F;basedefs&#x2F;xbd_...</a>)
评论 #17379685 未加载
评论 #17377727 未加载
derefr将近 7 年前
This, plus the problem of dealing with files with spaces, newlines, tabs, etc. in their names, are what draw the line for me between &quot;things I am willing to write as a shell script&quot; and &quot;things that will make me use a scripting language† with its own file-manipulation system-call builtins.&quot;<p>A three-line script that takes one file as an argument? Sure, write that in bash.<p>A script that processes N files passed as arguments? Or that processes a <i>listing</i> of files piped in from stdin? And uses branching logic on the files themselves? Bash goes out the window.<p>Sure, it&#x27;s <i>possible</i> to write shell scripts to do that. But why? Unless you&#x27;re targeting a PDP11 or the Busybox-linked &#x2F;bin&#x2F;sh in your initramfs, is shell scripting really the <i>best</i> option?<p>---<p>† Personally, I reach for Ruby in these cases; its stdlib Pathname and FileUtils classes are pretty solid for this use-case, and Ruby interpreters are now roughly everywhere I want to deploy.<p>Ruby <i>is</i> kind of clumsy for doing all the command piping parts of scripting, though; especially since there&#x27;s no easy way short of wrapping Kernel.system in your own function to make a Ruby script crash on a nonzero subshell exit status.<p>I&#x27;d love to know if there was a language that was like Ruby in terms of the syntax and semantics around strings, arrays, and files; but then was &quot;just like writing a shell script&quot; in the sense of being able to just use binary names to make &quot;function calls&quot; that are really synchronous subshell spawns and exit-code checks in one (but which still use the variable-passing semantics of the language where the resulting exec(2) ARGV is concerned.) Probably a Ruby DSL is the simplest way to get that—but if it&#x27;s not in the stdlib, I&#x27;m not going to be able to use it for DevOps scripting :&#x2F;
评论 #17377540 未加载
评论 #17379535 未加载
评论 #17378861 未加载
dwheeler将近 7 年前
Here are some of my pages on attacks via filenames and how to counter them...<p><a href="https:&#x2F;&#x2F;www.dwheeler.com&#x2F;essays&#x2F;fixing-unix-linux-filenames.html" rel="nofollow">https:&#x2F;&#x2F;www.dwheeler.com&#x2F;essays&#x2F;fixing-unix-linux-filenames....</a><p><a href="https:&#x2F;&#x2F;www.dwheeler.com&#x2F;essays&#x2F;filenames-in-shell.html" rel="nofollow">https:&#x2F;&#x2F;www.dwheeler.com&#x2F;essays&#x2F;filenames-in-shell.html</a><p>It is not really just a shell problem.
pixelbeat__将近 7 年前
This is one of the reasons GNU ls now quotes names with unsafe characters by default, so the common case of copy and pasting output from ls to commands will be safe, or if typing the argument, there is a visual indication of a potential issue.<p>If one want the older unsafe defaults you can add -N to your ls alias
jwilk将近 7 年前
Is there a more comphesensive list of command line options that can be abused in argument injection attacks?
评论 #17378129 未加载