src-test2/lib/libc/gen/wordexp.3, branch stable/10

MFC r288430: wordexp: Rewrite to make WRDE_NOCMD reliable.

2015-10-25T17:17:50Z

Shell syntax is too complicated to detect command substitution and unquoted operators reliably without implementing much of sh's parser. Therefore, have sh do this detection. While changing sh's support anyway, also read input from a pipe instead of arguments to avoid {ARG_MAX} limits and improve privacy, and output count and length using 16 instead of 8 digits. The basic concept is: execl("/bin/sh", "sh", "-c", "freebsd_wordexp ${1:+\"$1\"} -f "$2", "", flags & WRDE_NOCMD ? "-p" : "", ); The WRDE_BADCHAR error is still implemented in libc. POSIX requires us to fail strings containing unquoted braces with code WRDE_BADCHAR. Since this is normally not a syntax error in sh, there is still a need for checking code in libc, we_check(). The new we_check() is an optimistic check that all the characters | & ; < > ( ) { } are quoted. To avoid duplicating too much sh logic, such characters are permitted when quoting characters are seen, even if the quoting characters may themselves be quoted. This code reports all WRDE_BADCHAR errors; bad characters that get past it and are a syntax error in sh return WRDE_SYNTAX. Although many implementations of WRDE_NOCMD erroneously allow some command substitutions (and ours even documented this), there appears to be code that relies on its security (codesearch.debian.net shows quite a few uses). Passing untrusted data to wordexp() still exposes a denial of service possibility and a fairly large attack surface. This is also a MFC of r286830 to reduce conflicts. I changed the code somewhat to avoid changes from r286941; in particular, WRDE_BADVAL can still only be returned if WRDE_UNDEF was passed. Relnotes: yes Security: fixes command execution with wordexp(untrusted, WRDE_NOCMD)

Correct usage example.

2006-04-18T21:37:24Z

PR: docs/95059 Submitted by: Jos Backus MFC after: 4 days

Document incorrect handling of multibyte characters due to limitations

2004-07-28T15:43:33Z

of sh(1).

Fix typo: WRDE_DOOFS -> WRDE_DOOFFS.

2004-06-30T13:55:08Z

Noticed by: Stoned Elipot

mdoc(7): Use the new feature of the .In macro.

2003-09-08T19:57:22Z

Assorted mdoc(7) fixes.

2003-06-01T19:19:59Z

Document return type of wordfree() (void). Reduce the space between

2003-03-13T11:18:53Z

struct member names and the corresponding comments so the lines don't wrap on 80-column terminals.

It is no longer necessary to include sys/types.h before wordexp.h.

2003-01-03T12:04:36Z

Fix a small typo.

2002-12-27T08:28:53Z

Add an implementation of the POSIX wordexp() and wordfree() functions,

2002-12-26T14:34:18Z

which perform shell-style word expansion on strings. This is still a little rough around the edges. PR: 13420