From: "Christoph (Stucki) von Stuckrad" <stucki@mi.fu-berlin.de>
To: zsh-workers@zsh.org
Subject: Re: [BUG] Unicode variables can be exported and are exported metafied
Date: Fri, 19 Dec 2014 19:17:37 +0100 [thread overview]
Message-ID: <20141219181652.GA3996@localhost.mi.fu-berlin.de> (raw)
In-Reply-To: <CAH+w=7YZ3kk4mMiZxFdqv1krhsGg7zSCjJr---u9Q9ZmbdJ5hA@mail.gmail.com>
On Thu, 18 Dec 2014, Bart Schaefer wrote:
> Are we sure it's even "legal" to export Unicode variable names? Internally
> we can kinda ignore POSIX as we choose, but the environment crosses those
> boundaries.
Independend of being 'legal' to me it seems dangerous!
Comparing the 'working as written' example:
~$ M='surprise; : ' MÄRCHEN=story sh -c 'echo $MÄRCHEN'
story
to running it with all the other shells I keep around
(bash, dash, ash, sash - untested ksh and csh)
you always get:
..................................vvvv
~$ M='surprise; : ' MÄRCHEN=story bash -c 'echo $MÄRCHEN'
surprise; : ÄRCHEN
Which gives interesting new ways to introduce security-sensitive
changes into environments by letting a Program check the
UTF8-named-Variable for its contents, but really inserting data
by the broken-part-name, which might be passed unchecked!
So PLEASE DO NOT EXPORT these !
Stucki
--
Christoph von Stuckrad * * |nickname |Mail <stucki@mi.fu-berlin.de> \
Freie Universitaet Berlin |/_*|'stucki' |Tel(Mo.,Mi.):+49 30 838-75 459|
Mathematik & Informatik EDV |\ *|if online| (Di,Do,Fr):+49 30 77 39 6600|
Takustr. 9 / 14195 Berlin * * |on IRCnet|Fax(home): +49 30 77 39 6601/
next prev parent reply other threads:[~2014-12-19 18:17 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-12-18 18:19 ZyX
2014-12-18 19:29 ` Peter Stephenson
2014-12-18 19:47 ` Peter Stephenson
2014-12-18 19:58 ` Bart Schaefer
2014-12-18 20:09 ` Peter Stephenson
[not found] ` <54933513.6010501@case.edu>
2014-12-18 20:20 ` Fwd: " Bart Schaefer
2014-12-19 9:29 ` Christoph (Stucki) von Stuckrad
2014-12-19 18:17 ` Christoph (Stucki) von Stuckrad [this message]
2014-12-19 20:13 ` Павлов Николай Александрович
2014-12-19 21:21 ` Peter Stephenson
2014-12-19 22:44 ` ZyX
2014-12-20 0:13 ` Stephane Chazelas
2014-12-20 9:27 ` ZyX
2014-12-20 10:08 ` Stephane Chazelas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20141219181652.GA3996@localhost.mi.fu-berlin.de \
--to=stucki@mi.fu-berlin.de \
--cc=zsh-workers@zsh.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/zsh/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).