Conversation

Notices

1. @mcscx@quitter.se (mcscx@quitter.se)'s status on Wednesday, 12-Jul-2017 16:40:11 UTC @mcscx@quitter.se

   • drak
   • Benedikt Geißler 🐃
   @benediktg don't try this (unless you want to delete your home dir): "touch -- -rf \$HOME askme; rm *" @drak #DONTTRYTHISATHOME
   • drak (drak@sn.1w6.org)'s status on Wednesday, 12-Jul-2017 15:05:42 UTC drak
     mkdir -p /tmp/ask; cd /tmp/ask && touch -- -i askme && rm *
     @mcscx@quitter.se and Hallå Kitteh like this.
     @mcscx@quitter.se and Hallå Kitteh repeated this.
   • @mcscx@quitter.se (mcscx@quitter.se)'s status on Wednesday, 12-Jul-2017 15:30:22 UTC @mcscx@quitter.se

     • drak
     @drak Nice one :-) A reminder to prefer ./* to *.
     ghostDancer and Hallå Kitteh like this.
   • @mcscx@quitter.se (mcscx@quitter.se)'s status on Wednesday, 12-Jul-2017 16:50:29 UTC @mcscx@quitter.se

     • Benedikt Geißler 🐃
     @benediktg oh, interesting, why is your "-i" file still there? Doesnt zsh expand "*" to "-i askme"?
   • @mcscx@quitter.se (mcscx@quitter.se)'s status on Friday, 14-Jul-2017 10:06:56 UTC @mcscx@quitter.se

     in reply to

     • drak
     @drak indeed it doesnt work. It seems bash doesn't do variable expansion after pathname expansion.I wonder if there are other malicious ways
   • @mcscx@quitter.se (mcscx@quitter.se)'s status on Friday, 14-Jul-2017 10:24:08 UTC @mcscx@quitter.se

     in reply to

     • GNU Bash
     !bash tip: After setting "shopt -s extglob" you can exclude patterns from bash's #pathname #expansion:
     ls /bin/!(*a*|*b*)
   • @mcscx@quitter.se (mcscx@quitter.se)'s status on Friday, 14-Jul-2017 10:24:08 UTC @mcscx@quitter.se

     in reply to

     • GNU Bash
     !bash tip: After setting "shopt -s extglob" you can exclude patterns from bash's #pathname #expansion:
     ls /bin/!(*a*|*b*)
     Hallå Kitteh repeated this.
   • @mcscx@quitter.se (mcscx@quitter.se)'s status on Friday, 14-Jul-2017 23:25:21 UTC @mcscx@quitter.se

     • Dave Morriss
     @perloid nice! I had to enable extglob here. Probably Debian used to leave it disabled some years ago when I originally installed the system
   • Hallå Kitteh (clacke@social.heldscal.la)'s status on Monday, 17-Jul-2017 08:31:52 UTC Hallå Kitteh

     in reply to
     @mcscx Ooh, yes, nice workaround.
     
     Or just, in scripts always put filenames after `--` when possible. It's hard enough to quote everything everywhere.
     @mcscx@quitter.se likes this.
   • Hallå Kitteh (clacke@social.heldscal.la)'s status on Monday, 17-Jul-2017 08:34:08 UTC Hallå Kitteh

     in reply to

     • Dave Morriss
     @mcscx Nope, the evaluation order of the various replacements in bash is pretty clearly documented, and I'm sure it's in one of @perloid's excellent episodes. :-)
     @mcscx@quitter.se likes this.
   • Dave Morriss (perloid@quitter.se)'s status on Monday, 17-Jul-2017 08:58:27 UTC Dave Morriss

     in reply to

     • Hallå Kitteh
     @clacke @mcscx Yes, my episodes on expansion all mention this (with links to episodes covering each bit!).
     Hallå Kitteh likes this.
     Claes Wallin (韋嘉誠) repeated this.