X-Git-Url: https://sipb.mit.edu/gitweb.cgi/wiki.git/blobdiff_plain/02b1fab21a8fc6416023402338dc26e6491a8fc8..b709f5d23a17604789c1bd315a5a074f7644da56:/doc/safe-shell.mdwn

diff --git a/doc/safe-shell.mdwn b/doc/safe-shell.mdwn
index 7b8f601..f2cf726 100644
--- a/doc/safe-shell.mdwn
+++ b/doc/safe-shell.mdwn
@@ -101,6 +101,16 @@ manual](http://www.gnu.org/software/bash/manual/html_node/Special-Parameters.htm
 for details on the distinction between `$*`, `$@`, and `"$@"` — the first
 and second are rarely what you want in a safe shell script.
 
+## Passing filenames or other positional arguments to commands
+
+If you get filenames from the user or from shell globbing, or any other kind of positional arguments, you should be aware that those could start with a "-". Even if you quote correctly, this may still act differently from what you intended. For example, consider a script that allows somebody to run commands as `nobody` (exposed over `remctl`, perhaps), consisting of just `sudo -u nobody "$@"`. The quoting is fine, but if a user passes `-u root reboot`, `sudo` will catch the second `-u` and run it as `root`.
+
+Fixing this depends on what command you're running.
+
+For many, however, `--` is accepted to indicate that any options are done, and future arguments should be parsed as positional parameters --- even if they look like options. In the `sudo` example above, `sudo -u nobody -- "$@"` would avoid this attack (though obviously limiting which users commands can be run as in the `sudo` configuration should be done as well).
+
+Another approach is to prefix each filename with `./`, if the filenames are expected to be in the current directory.
+
 ## Temporary files
 
 TODO: mumble `mktemp`?