Pádraig Brady <[email protected]> writes: > On 26/05/2026 12:19, Pádraig Brady wrote: >> On 26/05/2026 07:54, Michał Majchrowicz wrote: > >>> We are reporting output-encoding vulnerabilities we identified in >>> GNU coreutils readlink, realpath, and basename while reviewing how >>> pathnames are rendered. > >> As mentioned previously, this quoting would not be appropriate >> for non interactive use as it would break scripts. >> All these commands have a --zero option to avoid the multi-line issue >> by using NUL terminated records. >> For interactive use, there is a stronger argument to quote, >> especially since our quoting format is now POSIX standardized. >> We'd have to support disabling this behavior though, >> which could be done I suppose with the use of the >> QUOTING_STYLE env var (like for ls). >> I'd be reluctant to add --quoting-style options to these commands. >> BTW we've some general notes on reasons to quote at: >> https://www.gnu.org/software/coreutils/quotes.html > While basename, readlink, and realpath aren't often used interactively, > I have done so occasionally, especially with realpath. > So it's worth these avoiding outputting arbitrary data to terminals. > > The attached patches implements quoting for these 3 commands > when outputting to tty, but being careful to _not_ quote > if not outputting to tty. tty quoting style can be configured/disabled > through the $QUOTING_STYLE env variable. > The default style is shell-escape (like with ls), > which avoid quoting unless needed. > > Also attached is a similar quoting adjustment for du, > which is warranted as that's usually used interactively.
I haven't looked at the patches yet, but I guess 'id', 'who', etc. might as well be changed while we are at it. User and group names can theoretically have bytes that are invalid characters in the current locale. In practice, if you are using non-ASCII characters you are probably asking for trouble. Collin
