Shell Security Problems

Jump to bottom Edit New page

andychu edited this page Mar 7, 2017 · 10 revisions

TODO: Link to good resources on the web.

rm -f * -- a file named '-r' can be interpreted as a flag
globbing happens after variable expansion. code as data
escaping from generating programs (shell, HTML, what else?)
bash shellshock: this was storing code in environment variables. code as data is an anti-pattern.

Pedantic Style

Motivation for Oil: get rid of pedantic style. ShellCheck enforces it.

double quote everything (except it's not necessary for RHS of assignment)
add -- after everything, e.g. cd -- $dir not cd $dir