A long time ago, Robert Elz <[email protected]> wrote:
[ ... ]
> What we do next depends upon what assumptions we're willing to make.
> If (which would probably be reasonable for rc.d/* files) we would be
> willing to assume there will be no files containing ' characters, then
> we're good. We don't have to just blindly press ahead assuming that
> of course, we can check for it, and refuse to continue (or with a little
> extra work, just skip any such file names, if that would be acceptable)
> by changing the filelist function to be:
>
> filelist()
> {
> local names=$1
> local A
>
> set -- $names # $names, from $1, will be something like *.jpg
> for A
> do
> case "$A" in
> *\'*) ;; # bad filename , do nothing
> *) printf "'%s' " "$A";; # good filename, keep
> esac
> done
> }
I think the first "local" statement should be:
local names="$1"
Otherwise the function might be tricked by maliciously
constructed file names.
-jarle
--
"Filenames are only for people who can't remember where they put their
files." -- Tarjei T. Jensen
