Beware xargs security holes

John R. MacMillan john at sco.COM
Mon Oct 29 11:04:35 AEST 1990


|>
|>find / -name '#*' -print | xargs patok '.*/#[^/]*' rm -f --
|>
|>where patok elimnates arguments that don't match the pattern.
|>[patok] shouldn't be too hard to write.
|
|find / -name '#*' -print | egrep -v '.*/#[^/]*' | xargs rm -f --

Of course by the time I'd realized this, Blair had already pointed it
out.  It's so much more painless when you catch your own mistakes.

Speaking of which, you probably don't want the -v to egrep unless you
want to remove only the files the nasty guy wanted you to, and the
pattern should probably have been '/#[^/]*$'.

So now that we can all safely and automatically remove files I think
we should kill this thread before I embarass myself further.
-- 
John R. MacMillan       | I'm in love with a McDonald's girl
SCO Canada, Inc.        | She's an angel in a polyester uniform.
john at sco.COM            |      -- barenaked ladies



More information about the Comp.unix.shell mailing list