Beware xargs security holes

[Boyd Roberts]

In article <3940 at awdprime.UUCP> tif at doorstop.austin.ibm.com (Paul Chamberlain) writes:
>
>In any case, I've yet to see how "a malicious user [could]
>remove every file on the system."
>

Nor can I.  Since when did xargs(1) use system(3)?

A malicious user may be able to embed newlines in filenames,
but that's not going to trash the _whole_ file-system.

If someone did change xargs(1) to use system(3) it's obviously been broken.
Using system(3) raises all sorts of revolting shell quoting problems -- not
to mention the security holes.



Boyd Roberts			boyd at necisa.ho.necisa.oz.au

``When the going gets wierd, the weird turn pro...''