Update IS&T keytab request form link

[wiki.git] / doc / safe-shell.mdwn

diff --git a/doc/safe-shell.mdwn b/doc/safe-shell.mdwn
index 4913abfd081af90f05c95e192a38c212237cf686..d6e5049b116e690fd78562b75b540a45784fd22a 100644 (file)
--- a/doc/safe-shell.mdwn
+++ b/doc/safe-shell.mdwn
@@ -18,11 +18,8 @@ variety of command-line utilities available. Much of that functionality will be
 available through libraries in Python or other languages. For the handful of
 things that aren't, you can still call external programs. In Python, the
 [subprocess](http://docs.python.org/2/library/subprocess.html) module is very
 available through libraries in Python or other languages. For the handful of
 things that aren't, you can still call external programs. In Python, the
 [subprocess](http://docs.python.org/2/library/subprocess.html) module is very

-useful for this. It also has two big advantages over shell — it's a lot
-easier to avoid
-[word-splitting](http://www.gnu.org/software/bash/manual/html_node/Word-Splitting.html)
-or similar issues, and since calls to subprocess will tend to be relatively
-uncommon, it's easy to scrutinize them especially hard.
+useful for this. You should try to avoid passing `shell=True` to `subprocess` (or using `os.system` or similar functions at all), since that will run a shell, exposing you to many of the same issues as plain shell has. It also has two big advantages over shell — it's a lot easier to avoid
+[word-splitting](http://www.gnu.org/software/bash/manual/html_node/Word-Splitting.html) or similar issues, and since calls to subprocess will tend to be relatively uncommon, it's easy to scrutinize them especially hard. When using `subprocess` or similar tools, you should still be aware of the suggestions in "Passing filenames or other positional arguments to commands" below.

 
 ## Shell settings
 
 
 ## Shell settings
 


@@ -107,7 +104,7 @@ If you get filenames from the user or from shell globbing, or any other kind of
 
 Fixing this depends on what command you're running.
 
 
 Fixing this depends on what command you're running.
 

-For many, however, `--` is accepted to indicate that any options are done, and future arguments should be parsed as positional parameters --- even if they look like options. In the `sudo` example above, `sudo -u nobody -- "$@"` would avoid this attack (though obviously limiting this in the `sudo` configuration should be done as well).
+For many commands, however, `--` is accepted to indicate that any options are done, and future arguments should be parsed as positional parameters — even if they look like options. In the `sudo` example above, `sudo -u nobody -- "$@"` would avoid this attack (though obviously specifying in the `sudo` configuration that commands can only be run as `nobody` is also a good idea).

 
 Another approach is to prefix each filename with `./`, if the filenames are expected to be in the current directory.
 
 
 Another approach is to prefix each filename with `./`, if the filenames are expected to be in the current directory.
 


@@ -115,9 +112,13 @@ Another approach is to prefix each filename with `./`, if the filenames are expe
 
 TODO: mumble `mktemp`?
 
 
 TODO: mumble `mktemp`?
 

+## Other resources
+
+Google has a [Shell Style Guide](https://google.github.io/styleguide/shell.xml). As the name suggests, it primarily focuses on good style, but some items are safety/security-relevant.
+

 ## Conclusion
 
 When possible, instead of writing a "safe" shell script, *use a higher-level
 language like Python*. If you can't do that, the shell has several *options* that
 you can enable that will reduce your chances of having bugs, and you should be
 ## Conclusion
 
 When possible, instead of writing a "safe" shell script, *use a higher-level
 language like Python*. If you can't do that, the shell has several *options* that
 you can enable that will reduce your chances of having bugs, and you should be

-sure to *quote liberally*.
+sure to *quote liberally*.