[TheJoeMan]

This may be a naive take, so if anyone has insight please feel free to share, but across Windows, Mac, and Linux OS's I see many cases of path parsing vulnerabilities resulting in sandbox escapes, code execution, or data access issues. When presenting the user with a file picker or command-line input, is it really needed that the software can handle the full POSIX spec?

I do not see a "typical" user needing to access a path with say a network storage but multiple ../.. and hard and soft symlinks simultaneously. I think "be liberal in what you accept" might need to be revisited for path parsing with some sort of OS-wide single-implementation as an optional feature.

[acuozzo]

> I do not see a "typical" user needing to access a path with say...

Typical users run software written by atypical users.

> some sort of OS-wide single-implementation

How do you propose handling migration? What if someone tries to expand an old archive file containing a now-forbidden path?

[TheJoeMan]

What I mean is that for “honest” software, built-in to the OS or otherwise, the programmer finds a situation where they take some user-supplied input and concatenate that into a path, and call something like OS.read(). If they want to prevent the user from causing havoc, they now find themselves dealing with path validation in their software instead of calling OS.safeOpen(), which would be a reduced subset of allowed chars?

[SoftTalker]

If the OS is working properly, the havoc should just result in "permission denied."

If there's a path on the system that the user should not be able to read, that's the job of the OS to handle, not the individual applications.

[eviks]

How is it permission denied if the app is running as admin? The OS "handled" it by giving admin app admin access. Sure, it was tricked by the user input, but that's what the fixes are for?

[catlifeonmars]

How would you enforce a single implementation of path parsing?