[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 13 Dec 2012 16:20:18 +0100
From: Colomban Wendling <lists.ban@...besfolles.org>
To: Andreas Ericsson <ae@....se>
CC: Jan Lieskovsky <jlieskov@...hat.com>,
Eitan Adler <lists@...anadler.com>,
"Steven M. Christey" <coley@...us.mitre.org>,
Nick Treleaven <nick.treleaven@...nternet.com>,
Enrico Troeger <enrico.troeger@...na.de>,
Matthew Brush <mbrush@...ebrainz.ca>,
Frank Lanitz <frank@...nk.uvena.de>, josef@...icpanda.com,
jonathan underwood <jonathan.underwood@...il.com>,
oss-security@...ts.openwall.com
Subject: Re: Geany IDE not escaping filenames during compilation
/ build - a security issue or not?
Le 13/12/2012 12:51, Andreas Ericsson a écrit :
> On 12/13/2012 12:21 PM, Jan Lieskovsky wrote:
> [...]
>
>> The difference when running it directly from the command line is
>> that Bash would escape those files for you, so even with crafted names
>> nothing bad / suspicious would happen (and project would build
>> if syntactically correct).
>>
>
> Except that people wouldn't manually compile thousands of files
> one by one. That's where build systems come in.
Yes, and for manual compilation to even have a chance to work one would
tweak a lot the build command to match the project's needs (inclusion
paths, link paths, etc.), so one has to be told to do so.
So I don't think it's more problematic than telling an user to run say,
"sudo cp -f that_file_I_sent_you /bin/sh". Nobody can protect an user
from that, only the user can do it.
>> To the difference, in the Geany scenario, the file name(s) would
>> be passed to command line directly as they are (and if the project
>> would build or not at the end isn't what matters here).
>>
>
> For the original report to be valid, the file would still have to
> be loaded into geany, or the report should have been about some
> other program. This is not a security issue that concerns geany.
All this said, I think the issue should still be addressed, because
although it doesn't looks so security-related to me, it's not good to
choke on quotes or whatever. But that's not oss-security's problem :)
Regards,
Colomban
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
