Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 29 Dec 2022 12:56:22 -0500
From: "David A. Wheeler" <>
Cc: Demi Marie Obenour <>,
 Alejandro Colomar <>,
 Michael Kerrisk <>
Subject: Re: [patch] proc.5: tell how to parse /proc/*/stat

> On Dec 29, 2022, at 11:43 AM, Alan Coopersmith <> wrote:

Another solution is to escape bytes that might cause trouble in this field, e.g., using %xx hexadecimal.
So space would be %20, ")" would be %41, control characters 1-31 would be %01 to %1f,
and (of course) "%" would be encoded as %25.
Basically, URL-encode / Percent-encode them. See:

Technically this would be a userspace change, but only in cases where the system
would probably have done the wrong thing previously. It's okay if we break *attacker* workflows
as long as we don't break others'. An advantage of URL encoding is that,
like JSON, it's a well-known format. I might do something different if this was a new system,
but that seems like the least-impact approach while eliminating the problem.

--- David A .Wheeler

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.