Re: shell quoting

[Jarle Greipsland <jarle.greipsland%norid.no@localhost>]

A long time ago, Robert Elz <kre%munnari.OZ.AU@localhost> wrote:
[ ... ]
> What we do next depends upon what assumptions we're willing to make.
> If (which would probably be reasonable for rc.d/* files) we would be
> willing to assume there will be no files containing ' characters, then
> we're good.   We don't have to just blindly press ahead assuming that
> of course, we can check for it, and refuse to continue (or with a little
> extra work, just skip any such file names, if that would be acceptable)
> by changing the filelist function to be:
> 
> 	filelist()
> 	{
> 		local names=$1
> 		local A
> 
> 		set -- $names   # $names, from $1, will be something like *.jpg
> 		for A
> 		do
> 			case "$A" in
> 			*\'*)	;;	# bad filename , do nothing
> 			*)      printf "'%s' " "$A";;  # good filename, keep
> 			esac
> 		done
> 	}
I think the first "local" statement should be:
	local names="$1"
Otherwise the function might be tricked by maliciously
constructed file names.

				-jarle
-- 
"Filenames are only for people who can't remember where they put their
 files."			-- Tarjei T. Jensen