Hi everyone! I second calling it "allow-unsafe-names" for the following reasons:
1. Many programs assume that usernames are so inert that they can be used in shell strings without proper escaping. For example, a user named $(touch /tmp/pwn) will create /tmp/pwn upon the first launch of an interactive bash, because the default bash PS1 interpolates the username before doing command substitution. adduser doesn't allow whitespace or forward slashes in usernames, even with --allow-all-names, but you can still get the same behavior with the username $(>`printf$IFS"\x2ftmp\x2fpwn"`). How this works is left as an exercise for the reader. Once you figure it out, see if you can out-golf us :) 2. There's a path traversal bug in useradd (but not adduser) that can be triggered by usernames beginning with "../". For example, for the username "../bin/brangal", useradd will create a home directory at /home/../bin/brangal (i.e. /bin/brangal). This can be used to place a directory owned by the new user nearly anywhere on the system. -Ben Kallus && Jonah Weinbaum
