Hi, One correction and additional info on my previous mail.
> Yes, because of misplaced double-quoting, current h2.sh does work > on the directory described before. Try it. Current h2.sh does _not_ work on the directory with spaces. ----- > mkdir 'weird dir' > unzip -d 'weird dir' h2-2012-02-03.zip > sh 'weird dir/h2/bin/h2.sh' Exception in thread "main" java.lang.NoClassDefFoundError: org/h2/tools/Console Caused by: java.lang.ClassNotFoundException: org.h2.tools.Console ... ----- GNU dirname outputs the error. -- dirname: extra operand `dir/h2/bin/h2.sh' Try `dirname --help' for more information. -- BSD derived dirname outputs each 'dirname' of arguments, so $cp is -- weird dir/h2/bin/h2-1.x.x.jar -- Directories with spaces, writing arguments with spaces on the command line, are not normal(some user with encrypted DB, possibly want to write password with spaces), and this quoting issue is not as critical as SQL injection at all, but still these issue should be fixed. Thanks, --- Fumiyuki Shimizu > 2012/2/25 Thomas Mueller <[email protected]> >> I'm don't want to make the shell script more complex. In my view, >> shell scripts should be very simple and very short. > Yes, I understand it, and I'm sorry for confusing you by mixing > problems and features. >> If that means some features can't be supported, that's fine for me. > No, it is not only a feature request, but I mainly mean that the > syntax of quoting is not good. >> If you can make the shell script shorter, then we can discuss it, >> but it if's longer then I'm against it. > Reduced 100bytes from the h2 version, so let's discuss it. >>> a. h2-1.3.*.jar is located on the current working directory and >>> h2.sh is not. >> That's not a use case I plan to support. > OK, current h2.sh becomes to be protectable from the attack by > putting rogue h2.jar on someone's working directory > (e.g. /tmp). That is fine(h2.bat is not), but now we cannot > override the h2 driver even by setting H2DRIVERS, because the > driver specified by $cp always exists unless we remove or move it > from bin/. >>> b. h2.sh is located on the directory whose name contains spaces, >>> such as '/opt/foo bar/h2.sh' The former case breaks the >>> compatibility to the older versions. >> So the recent change broke this feature? > Yes, because of misplaced double-quoting, current h2.sh does work > on the directory described before. Try it. > e.g. '/opt/h2 database/h2.sh' > dirname command can take only one argument. > http://pubs.opengroup.org/onlinepubs/007904875/utilities/dirname.html >>> I also found the one more rare case same as 'b.': >>> c. Web browser is located on the directory containing spaces, such as >>> java org.h2.tools.Console -browser '/opt/web browser/browser' >> This is not a supported command line feature. The browser can't be set >> in that way. > This is just a quoting manner(syntax), and there are more parameters > for o.h.t.Console other than -browser. > To pass $1 $2 $3.... of h2.sh to java as they are, $@ should be "$@" > e.g. current(including older versions) h2.sh > command line: ./h2.sh -password 'this is a password' -url > 'file:/weired dir/db' -user 'hoge' > $0: ./h2.sh > $1: -password > $2: this is a password > java receives: > args[0]: -password > args[1]: this > args[2]: is > args[3]: a > args[4]: password > To fix this, $@ must be "$@", then you get > args[0]: -password > args[1]: this is a password > This is the shortest and fixed above two problems. > --- > #!/bin/sh > dir=$(dirname "$0") > java -cp "$dir/h2-1.3.164.jar:$H2DRIVERS:$CLASSPATH" org.h2.tools.Console > "$@" > --- > Please change the order of H2DRIVER, if you think the variable if for > overriding the default drivers. > You can get the same result($(dirname)) with this h2.bat, and h2w.bat > --- > @java -cp "%~dp0\h2-1.3.164.jar;%H2DRIVERS%;%CLASSPATH%" > org.h2.tools.Console %* > @if errorlevel 1 pause > --- > @start javaw -cp "%~dp0\h2-1.3.164.jar;%H2DRIVERS%;%CLASSPATH%" > org.h2.tools.Console %* > @if errorlevel 1 pause > --- > Oh, increases 12bytes total. Sorry. > %* is not necessary to be quoted in Windows manner. > I hope these help. > --- > Fumiyuki Shimizu -- You received this message because you are subscribed to the Google Groups "H2 Database" group. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/h2-database?hl=en.
