From: "Павлов Николай Александрович" <kp-pav@yandex.ru>
To: "Christoph (Stucki) von Stuckrad"
<stucki@mi.fu-berlin.de>,zsh-workers@zsh.org
Subject: Re: [BUG] Unicode variables can be exported and are exported metafied
Date: Fri, 19 Dec 2014 23:13:10 +0300 [thread overview]
Message-ID: <EA0BA7A9-C9AC-4CDF-AEB0-83E10A4B7C5B@yandex.ru> (raw)
In-Reply-To: <20141219181652.GA3996@localhost.mi.fu-berlin.de>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
On December 19, 2014 9:17:37 PM EAT, "Christoph (Stucki) von Stuckrad" <stucki@mi.fu-berlin.de> wrote:
>On Thu, 18 Dec 2014, Bart Schaefer wrote:
>
>> Are we sure it's even "legal" to export Unicode variable names?
>Internally
>> we can kinda ignore POSIX as we choose, but the environment crosses
>those
>> boundaries.
>
>Independend of being 'legal' to me it seems dangerous!
>
>Comparing the 'working as written' example:
>
>~$ M='surprise; : ' MÄRCHEN=story sh -c 'echo $MÄRCHEN'
>story
>
>to running it with all the other shells I keep around
>(bash, dash, ash, sash - untested ksh and csh)
>you always get:
>
>..................................vvvv
>~$ M='surprise; : ' MÄRCHEN=story bash -c 'echo $MÄRCHEN'
>surprise; : ÄRCHEN
>
>Which gives interesting new ways to introduce security-sensitive
>changes into environments by letting a Program check the
>UTF8-named-Variable for its contents, but really inserting data
>by the broken-part-name, which might be passed unchecked!
>
>So PLEASE DO NOT EXPORT these !
>
>Stucki
I really do not see any problems here. If one has "surprise" in $M in an environment he runs typed scripts in then he already has much bigger problems.
-----BEGIN PGP SIGNATURE-----
Version: APG v1.1.1
iQJNBAEBCgA3BQJUlIbVMBwfMDI7PjIgHTg6PjswOSAQOzU6QTA9NEA+MjhHIDxr
cC1wYXZAeWFuZGV4LnJ1PgAKCRBu+P2/AXZZIuF9D/4oc9QkX4ziGW34IpiFzPmA
P4w5ZmbGFq8yV8IhYLX+SDukWSKP5j7K7CZgc6UU9Xftpr7RFbSXuRqyjTCWhzRM
mt6od3PeOI6+nEF+hizz+3WwqiHmrB/pagP7qed3gjX6t6y9qV7g+QCXdL7EPOQ/
uUKDoAjF0LPOc0JUtKXVJNZzE6YsCmVL/hwdeGG7pNQ7tOUeKEeS02XwNphAdUw4
5tuwE/UBRxtcPyCE3pVsV9vXa+1cyREuyY50uH/lMRGR8FuyjNmPslvRfDmzWkxw
x5OgxiyukBdxY4YLjiXuVLAVh/JqVmnZvMy2o6uqxESmv3tX8yOIjelFbwo6hZhz
L7RAdsXdw23OFBqxTrHxnSbImQuCn2yS2CrmQmBe3adilj84XIpqlpQCKy/LdXm7
LQyCGrI8gUwKLmpeqvaHrp3SbFfUZIbtMOaccQwPGBfH67JA0CUr+HZv3fJ/Iijm
F0LSsJTiQIgfeXXwk0nxHXUj/0yr5MEJUnVwFNY7C/tgOKRpDpwA5u2jgAvcYpUn
YHJddwyHryeghp2JpiECprUEd1nGRj4ijbGb4uolbs7CxVpR6z+IadEzsSg5bd2y
r499ADpGsuXM0U09unQUTMqsCaxW9y7VOeTqORSv/1jOG7O8vZIRIgLuyi+JYXsU
vMCYECRmzPKvIdYOsbQ7Gg==
=d7xB
-----END PGP SIGNATURE-----
next prev parent reply other threads:[~2014-12-19 20:24 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-12-18 18:19 ZyX
2014-12-18 19:29 ` Peter Stephenson
2014-12-18 19:47 ` Peter Stephenson
2014-12-18 19:58 ` Bart Schaefer
2014-12-18 20:09 ` Peter Stephenson
[not found] ` <54933513.6010501@case.edu>
2014-12-18 20:20 ` Fwd: " Bart Schaefer
2014-12-19 9:29 ` Christoph (Stucki) von Stuckrad
2014-12-19 18:17 ` Christoph (Stucki) von Stuckrad
2014-12-19 20:13 ` Павлов Николай Александрович [this message]
2014-12-19 21:21 ` Peter Stephenson
2014-12-19 22:44 ` ZyX
2014-12-20 0:13 ` Stephane Chazelas
2014-12-20 9:27 ` ZyX
2014-12-20 10:08 ` Stephane Chazelas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=EA0BA7A9-C9AC-4CDF-AEB0-83E10A4B7C5B@yandex.ru \
--to=kp-pav@yandex.ru \
--cc=stucki@mi.fu-berlin.de \
--cc=zsh-workers@zsh.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/zsh/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).