trcrsired wrote:
Linus Torvalds @torvalds:
```Security issues like "user space checked that the filename didn't
match some security-sensitive pattern". And then the shit-for-brains
filesystem ends up matching that pattern *anyway*, because the people
who do case insensitivity *INVARIABLY* do things like ignore
non-printing characters, so now "case insensitive" also means
"insensitive to other things too".
For examples of this, see commits
5c26d2f1d3f5 ("unicode: Don't special case ignorable code points")
and
231825b2e1ff ("Revert "unicode: Don't special case ignorable code points"")
and cry.
Hint: ❤ and ❤️ are two unicode characters that differ only in
ignorable code points. And guess what? The cray-cray incompetent
people who want those two to compare the same will then also have
other random - and perhaps security-sensitive - files compare the
same, just because they have ignorable code points in them.
So now every single user mode program that checks that they don't
touch special paths is basically open to being fooled into doing
things they explicitly checked they shouldn't be doing. And no, that
isn't something unusual or odd. *Lots* of programs do exactly that.```
He even argued case sensitivity is a security flaw.
https://github.com/llvm/llvm-project/pull/96417
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
