Pádraig Brady <[email protected]> writes:
> Similarly to commit v9.10-115-gb3fe24213, which applied
> the same quoting mechanism to --check operation,
> also quote file names when generating checksums to tty.
> This change gives these advantages:
>
> 1. Avoids dumping arbitrary data to vulnerable terminals
> 2. Avoids visual deception with ansi codes with unknown file names
> 3. More secure if users copy and paste file names from output
>
> * doc/coreutils.texi (sum invocation): Mention the tty quoting
> and reference the details from ...
> (cksum output modes): Describe the two forms of quoting used.
> * tests/misc/tty-quoting.sh: Add test cases.
> * NEWS: Mention the improvement.
>
> Discovered by Anthropic's OSS Scanner, as bug ANT-2026-Z25BP6MW.
I remember discussing this when Aaron Rainbolt kindly brought up the
more problematic case of us not quoting file names in 'cksum -c', which
could cause someone to be tricked into thinking they had verified a file
that they hadn't due to escape sequences in the checksum file. I CC'd
him, in case he wants the patch for himself.
It does look a bit funny with the quotes inside the parentheses:
$ touch a$'\n'b; src/cksum -a sha2 -l 224 a$'\n'b
SHA224 ('a'$'\n''b') =
d14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f
But I think it is a good change regardless.
Collin
[1]
https://github.com/coreutils/coreutils/commit/b3fe24213ee350835097cefa8d0154f78ffd9d67
