Re: How to do secure coding and create secure software

[Jacob Bachmeyer <jcb62281 () gmail com>]

On 9/30/25 00:23, Solar Designer wrote:
> [...]
> So is the vulnerability in the shell, like Shellshock was determined to
> be?  [...] the shell maintainers may well dispute this CVE on
> such grounds as well as because the shell worked exactly as documented. [...]

Small nit here:  Shellshock was clearly a vulnerability in Bash and I am 
unsure if the way Bash exports shell functions was documented at all.

If presented with an environment variable value having the correct form 
for a shell function, but containing more text than the body of the 
function, Bash would immediately execute the trailing text as commands 
while importing the shell function from the environment.  That was 
Shellshock.

This went unnoticed for years because Bash, of course, would never 
include trailing text when *exporting* a shell function, so the 
vulnerable code path went unexercised.  I have used Shellshock as a 
counterexample to claims that input validation is unneeded because the 
data will always be written correctly in the proper format by the same 
program.


-- Jacob