Re: shell wildcard expansion (un)safety

[Dominik Czarnota <dominik.b.czarnota () gmail com>]

This is known since even earlier by the article/disclosure „unix wildcards
gone wild”:
https://seclists.org/fulldisclosure/2014/Jun/136

The original article link seems to not work but it can be seen e.g. here:
https://github.com/Gandosha/gandosha.github.io/blob/master/DefenseCode_Unix_WildCards_Gone_Wild.txt

It shows that in some cases this can lead to code execution, e.g. with „tar
*”

On Fri, 8 Nov 2024 at 18:47, Georgi Guninski <gguninski () gmail com> wrote:

> This is known since at least 2019, but the distro list can't tell
> vulnerability from a rant [1] [2]
>
> `grep text -- *` is not portable solution, since not all warez recognize
> --.
>
> e.g.:
>
> $find . --
> find: unknown predicate `--'
>
>
> [1] Shell wildcards considered dangerous?
> https://seclists.org/oss-sec/2019/q4/133
>
> [2]
> https://www.linkedin.com/pulse/careful-wildcards-linux-rm-georgi-guninski-ieaif