zsh-workers
 help / color / mirror / code / Atom feed
From: Oliver Kiddle <okiddle@yahoo.co.uk>
To: Zsh Hackers' List <zsh-workers@zsh.org>
Subject: Re: [Bulk] PATCH: safe numeric import
Date: Wed, 01 Oct 2014 16:57:01 +0200	[thread overview]
Message-ID: <28168.1412175421@thecus.kiddle.eu> (raw)
In-Reply-To: <20140929110420.52cc66f8@pwslap01u.europe.root.pri>

Peter Stephenson wrote:
> OK, how about this?  When we're doing the import, all numbers, integer
> or floating point, are imported straight, without an evaluation.
> Sticking numbers into the environment to be evaluated later doesn't
> make a lot of sense.

This looks like a good approach. 

> Currently we suppress all errors from parameters at this stage, though
> we could make a special case and output errors when we truncate a
> numeric import because we ignored anything after an initial constant.

I think it's better not to have error messages because of anything
in the environment. Just sanitise as we see fit and then get on with
things. By the way, the example I had for readonlys such as status is
wrong: error's from the outer shell - I should have used env. For
functions, the error occurs later in module.c when it tries to add the
normal functions parameter so is harder to avoid.

Oliver


  parent reply	other threads:[~2014-10-01 15:03 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-09-24 14:45 zsh seems to be vulnerable to CVE-2014-6271: remote code execution through bash İsmail Dönmez
2014-09-24 14:54 ` Frank Terbeck
2014-09-24 14:55   ` İsmail Dönmez
2014-09-24 15:01   ` Peter Stephenson
2014-09-24 15:08     ` Frank Terbeck
2014-09-24 15:13     ` Jérémie Roquet
2014-09-24 14:55 ` Jérémie Roquet
2014-09-24 14:59 ` Chet Ramey
2014-09-25 13:11 ` Peter Stephenson
2014-09-26 14:03   ` Oliver Kiddle
2014-09-26 20:08     ` Peter Stephenson
2014-09-29 10:04       ` PATCH: safe numeric import Peter Stephenson
2014-09-29 15:24         ` Bart Schaefer
2014-10-01 14:57         ` Oliver Kiddle [this message]
2014-10-02 16:06         ` Peter Stephenson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=28168.1412175421@thecus.kiddle.eu \
    --to=okiddle@yahoo.co.uk \
    --cc=zsh-workers@zsh.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
Code repositories for project(s) associated with this public inbox

	https://git.vuxu.org/mirror/zsh/

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).