Hacker News new | ask | show | jobs
by Qantourisc 4283 days ago
I would still argue the bug is not entirely bash it's fault. A feature that causes security bugs, is imo the fault of the application using a program that has these feature. It's like not escaping strings/CLI-commands/SQL commands.

Or did I miss something where this bash feature is not suppose to work under all circumstances ?
4 comments
cnvogel 4283 days ago
It's certainly bash's fault!

First, and foremost: user-provided data has been passed in environment variables since the stone-age. That's why, for example, we explicitly guard against LD_PRELOAD'ing a shared library into a suid-binary... But it was common knowledge, that this selection of dangerous/benign variables can be made based on the NAME of the variable, NOT the CONTENT. And bash basically calls eval(name+' '+env[name]) for every variable containing the magic substring.

Imagine any of your other favourite script languages scanning random places for "things that look as if they could be imported/included/executed"... and tell me that this is a smart thing to do.

The second mistake was to not just create a function-definition inside the currently running program, but to actually eval the complete content of the variable. If bash would just postpone the evaluation of the function to the point in time where it's actually called, no one would be bothered, because the script would have to be tricked into executing a command called "RECIPIENT" (or DHCP_OPTION_1234, or COOKIE, ...).

link
clarry 4283 days ago
It's not a bash feature, it's a bug. It's not documented. It's impossible to properly escape strings to protect against nondocumented nonfeatures that cause data to be executed. Not at all comparable to the situation with SQL or command lines.
link
Qantourisc 4282 days ago
@cnvogel, clarry: Didn't knew it was not a feature. Didn't really read-up much of the issue, under time pressure lately.
link
kryptiskt 4283 days ago
If shit like what bash is doing here is to be expected from programs in the Unix world, the only reasonable solution is to write it off as a failed experiment and burn the whole Unix thing to the ground (well, maybe we can keep the kernels) and rebuild a new world from scratch in Rust.

This being a feature and not a bug is the far worse alternative, that means the badness is inherent.

link