Hi Antonio, > Maybe you need to quote every use of the file name, even the %: > > $ ed -v "*" > *: No such file or directory > ! > ! > r !echo "%" > echo "*" > 2 > p > * > Q
No, that’s too simplistic. Here’s a CVE scenario for you: $ ed "hello\"there" hello"there: No such file or directory !echo % echo hello"there sh: 1: Syntax error: Unterminated quoted string Shall we call it “ed(1) injection?” In any way, a proper escaping mechanism is really needed here, as you can see. While globs can we neutralized by wrapping them in quotes, option flags and quotes themselved cannot. Thanks, -- Artyom Bologov https://aartaka.me
