Re: I've found a vulnerability in bash

2021-11-17 Thread Alex fxmbsw7 Ratchev
this is due to parsing of args by specific app, -- arg indicates end-of-switches On Wed, Nov 17, 2021, 13:41 Marshall Whittaker wrote: > Software: bash > Version: 5.0.17(1)-release (x86_64-pc-linux-gnu) > > --- SNIP --- > [marshall@jerkon]{04:09 AM}: [~/bashful] $ touch -- '--version' >

Re: bash conditional expressions

2021-11-17 Thread Michael J. Baars
On Mon, 2021-11-15 at 09:23 -0500, Chet Ramey wrote: > On 11/12/21 4:36 AM, Mischa Baars wrote: > > > Could you please restore the Fedora 32 behaviour? Someone must have read > > the bash manual a little too precise, because now the statement only > > returns true when a 'touch -a test' is given

Re: bash conditional expressions

2021-11-17 Thread Michael J. Baars
On Fri, 2021-11-12 at 19:48 +0100, Andreas Schwab wrote: > FILE1 -nt FILE2 True if file1 is newer than file2 (according to >modification date). > > Andreas. > This would indeed also solve the problem at hand :)

I've found a vulnerability in bash

2021-11-17 Thread Marshall Whittaker
Software: bash Version: 5.0.17(1)-release (x86_64-pc-linux-gnu) --- SNIP --- [marshall@jerkon]{04:09 AM}: [~/bashful] $ touch -- '--version' [marshall@jerkon]{04:09 AM}: [~/bashful] $ touch a && mkdir b [marshall@jerkon]{04:09 AM}: [~/bashful] $ ls -l total 4 -rw-rw-r-- 1 marshall marshall0

I've found a vulnerability in bash

2021-11-17 Thread Marshall Whittaker
Software: bash Version: 5.0.17(1)-release --- SNIP --- [marshall@jerkon]{04:09 AM}: [~/bashful] $ touch -- '--version' [marshall@jerkon]{04:09 AM}: [~/bashful] $ touch a && mkdir b [marshall@jerkon]{04:09 AM}: [~/bashful] $ ls -l total 4 -rw-rw-r-- 1 marshall marshall0 Nov 17 04:09 a

Re: I've found a vulnerability in bash

2021-11-17 Thread Greg Wooledge
On Wed, Nov 17, 2021 at 03:47:15PM +0200, Ilkka Virta wrote: > I don't see this in BashFAQ, though. Is it because it's not strictly about > Bash? Greg? https://mywiki.wooledge.org/BashPitfalls#pf3

Re: bash conditional expressions

2021-11-17 Thread Ilkka Virta
On Wed, Nov 17, 2021 at 1:33 PM Andreas Schwab wrote: > On Nov 17 2021, Michael J. Baars wrote: > > > When -N stands for NEW, and touch (-am) gives you a new file > > It doesn't. The file hasn't been modified after it was last read. > touch creates the given file if it doesn't previously

Re: I've found a vulnerability in bash

2021-11-17 Thread Greg Wooledge
On Wed, Nov 17, 2021 at 04:16:36AM -0500, Marshall Whittaker wrote: > --- SNIP --- > [marshall@jerkon]{04:09 AM}: [~/bashful] $ touch -- '--version' > [marshall@jerkon]{04:09 AM}: [~/bashful] $ mv * b This isn't a vulnerability in bash. It's a bug in your script. Use this instead: mv -- * b

Re: I've found a vulnerability in bash

2021-11-17 Thread Chet Ramey
On 11/17/21 4:16 AM, Marshall Whittaker wrote: > This shouldn't happen beacuse you can drop a file and then redirect > other code for example calling a script if you only have access to drop > a file. Say a cronjob was running every hour, and it did rm * on some > folder, by expansion, you could

Re: bash conditional expressions

2021-11-17 Thread Andreas Schwab
On Nov 17 2021, Michael J. Baars wrote: > When -N stands for NEW, and touch (-am) gives you a new file It doesn't. The file hasn't been modified after it was last read. Andreas. -- Andreas Schwab, sch...@linux-m68k.org GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510 2552 DF73 E780 A9DA AEC1

Re: bash conditional expressions

2021-11-17 Thread Chet Ramey
On 11/17/21 5:16 AM, Michael J. Baars wrote: >> Why do you think `touch -am', which sets the atime and mtime to the same >> value, should make -N true? > > When -N stands for NEW It doesn't, though. It could just as easily be a mnemonic for "new activity in the file." You're using it to mean

Re: I've found a vulnerability in bash

2021-11-17 Thread Ilkka Virta
On Wed, Nov 17, 2021 at 2:42 PM Marshall Whittaker < marshallwhitta...@gmail.com> wrote: > [marshall@jerkon]{04:09 AM}: [~/bashful] $ touch -- '--version' > [marshall@jerkon]{04:09 AM}: [~/bashful] $ rm * > rm (GNU coreutils) 8.30 > Copyright (C) 2018 Free Software Foundation, Inc. > License

Re: Unclosed quotes on heredoc mode

2021-11-17 Thread Greg Wooledge
On Wed, Nov 17, 2021 at 06:30:08PM +, João Almeida Santos wrote: > Thank you for your reply Robert and Lawrence! > > I understand the description alone is hard to follow, so I think the image > below should make it clearer. Otherwise let me know! > > > Kind regards, > João Almeida Santos

Re: Unclosed quotes on heredoc mode

2021-11-17 Thread Robert Elz
Date:Wed, 17 Nov 2021 18:45:05 + From:=?utf-8?Q?Jo=C3=A3o_Almeida_Santos?= Message-ID: | No, it's on the email... It wasn't, but some lists filter attachments (remove them) - this might be one. | bash-5.1$ echo $PATH |

Re: Unclosed quotes on heredoc mode

2021-11-17 Thread João Almeida Santos
No, it’s on the email...Anyway, here’s the text! bash-5.1$ echo $PATH /usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin/:/usr/local/bin/:/usr/local/bin/ bash-5.1$ cat << $PATH > /usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin/:/usr/local/bin/:/usr/local/bin/ > it should have terminated with the upper

Re: Unclosed quotes on heredoc mode

2021-11-17 Thread Greg Wooledge
On Wed, Nov 17, 2021 at 06:45:05PM +, João Almeida Santos wrote: > bash-5.1$ cat << $PATH That's not how a here-document is intended to be used. A here-document lets you drop a blob of text directly into your script and use that as standard input for some command, without needing to store

Re: Unclosed quotes on heredoc mode

2021-11-17 Thread Chet Ramey
On 11/17/21 10:33 AM, Robert Elz wrote: > There are several (IMO) > bugs in the way bash processes here documents, Such as? -- ``The lyf so short, the craft so long to lerne.'' - Chaucer ``Ars longa, vita brevis'' - Hippocrates Chet Ramey, UTech, CWRUc...@case.edu

Re: Unclosed quotes on heredoc mode

2021-11-17 Thread João Almeida Santos
Thank you for your reply Robert and Lawrence! I understand the description alone is hard to follow, so I think the image below should make it clearer. Otherwise let me know! Kind regards, João Almeida Santos

Re: Unclosed quotes on heredoc mode

2021-11-17 Thread João Almeida Santos
Ok, got it. It makes sense now! Thank you very much for your detailed explanation guys; now that I understand it, I’ll try to implement that on my mini shell. It’s a bit too soon, but merry Christmas to you all! Kind regards, João Almeida Santos

Re: Unclosed quotes on heredoc mode

2021-11-17 Thread Chet Ramey
On 11/17/21 3:02 PM, Robert Elz wrote: > | bash-5.1$ cat << $PATH > > > | it should have terminated with the upper delimiter! > > What do you consider the "upper delimiter" ? > > This is one of the weirder aspects of shell syntax, and perhaps one > of bash's oddities. It's not. Every

Re: Unclosed quotes on heredoc mode

2021-11-17 Thread Alex fxmbsw7 Ratchev
u forgot to attach the picture .. ? On Wed, Nov 17, 2021, 19:31 João Almeida Santos wrote: > Thank you for your reply Robert and Lawrence! > > I understand the description alone is hard to follow, so I think the image > below should make it clearer. Otherwise let me know! > > > Kind regards, >

Re: Unclosed quotes on heredoc mode

2021-11-17 Thread Chet Ramey
On 11/17/21 1:45 PM, João Almeida Santos wrote: > No, it’s on the email...Anyway, here’s the text! > > bash-5.1$ echo $PATH > /usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin/:/usr/local/bin/:/usr/local/bin/ > > bash-5.1$ cat << $PATH >>

Unclosed quotes on heredoc mode

2021-11-17 Thread João Almeida Santos
Hello, First of all thank you for doing great (and free) software! I’m a programming student currently on 42 School in Lisbon, and one of our projects is to create a minishell, and to mimic the behavior of bash. While testing the heredoc mode, I realized that the $ is not interpreted as

Re: Unclosed quotes on heredoc mode

2021-11-17 Thread Lawrence Velázquez
On Wed, Nov 17, 2021, at 7:35 AM, João Almeida Santos wrote: > I’m a programming student currently on 42 School in Lisbon, and one of > our projects is to create a minishell, and to mimic the behavior of > bash. Nice! > While testing the heredoc mode, I realized that the $ is not >

Re: Unclosed quotes on heredoc mode

2021-11-17 Thread Robert Elz
Date:Wed, 17 Nov 2021 12:35:42 + From:=?utf-8?Q?Jo=C3=A3o_Almeida_Santos?= Message-ID: | While testing the heredoc mode, I realized that the $ is not | interpreted as variable expansion. It depends how you set up the heredoc, please give an example of

Re: Unclosed quotes on heredoc mode

2021-11-17 Thread Robert Elz
Date:Wed, 17 Nov 2021 15:47:37 -0500 From:Chet Ramey Message-ID: <420281e7-f3c4-8054-d390-9378080c2...@case.edu> | Every modern shell uses `$PATH' as the here-document delimiter Depends what you call modern shells - some ash derived shells (at least) don't,

Bash-5.1 Official Patch 9

2021-11-17 Thread Chet Ramey
BASH PATCH REPORT = Bash-Release: 5.1 Patch-ID: bash51-009 Bug-Reported-by:Julien Moutinho Bug-Reference-ID: <20211004035906.5kiobuzkpeckm...@sourcephile.fr> Bug-Reference-URL:

Bash-5.1 Official Patch 10

2021-11-17 Thread Chet Ramey
BASH PATCH REPORT = Bash-Release: 5.1 Patch-ID: bash51-010 Bug-Reported-by:Jonas Alfredsson Bug-Reference-ID: Bug-Reference-URL:

Bash-5.1 Official Patch 12

2021-11-17 Thread Chet Ramey
BASH PATCH REPORT = Bash-Release: 5.1 Patch-ID: bash51-012 Bug-Reported-by:Nikolay Borisov Bug-Reference-ID: <1a715205-06ce-413b-c1c0-2f5639ce0...@suse.com> Bug-Reference-URL:

Bash-5.1 Official Patch 11

2021-11-17 Thread Chet Ramey
BASH PATCH REPORT = Bash-Release: 5.1 Patch-ID: bash51-011 Bug-Reported-by:Alex fxmbsw7 Ratchev Bug-Reference-ID: Bug-Reference-URL:

Re: bash conditional expressions

2021-11-17 Thread Michael J. Baars
On Fri, 2021-11-12 at 19:48 +0100, Andreas Schwab wrote: > FILE1 -nt FILE2 True if file1 is newer than file2 (according to >modification date). > > Andreas. > So now we have a relation for 'older than' and for 'newer than', but how about 'oldest' (executable),

Re: bash conditional expressions

2021-11-17 Thread Michael J. Baars
On Wed, 2021-11-17 at 14:06 +0200, Ilkka Virta wrote: > On Wed, Nov 17, 2021 at 1:33 PM Andreas Schwab wrote: > > On Nov 17 2021, Michael J. Baars wrote: > > > > > > > > > When -N stands for NEW, and touch (-am) gives you a new file > > > > > > > > It doesn't. The file hasn't been modified