Re: Why is *splitting every word* is a shell security hole?

[Greg Wooledge]

On Wed, Aug 21, 2024 at 11:14:36 -0400, Chet Ramey wrote:
> On 8/19/24 7:41 AM, shynur . wrote:
> > Why is *splitting every word* is a shell security hole?
> 
> Consider setting IFS to something that's not the default and using it to
> split words (not expansions) that a user might reasonably expect to remain
> unchanged.
> 
> Then you write a shell function or script (or other executable) whose name
> is something like
> 
> `ec'
> 
> setting IFS="${IFS}h"
> 
> and you get to run it the next time the user uses `echo'.
> 
> This is obviously contrived, but the principle should be obvious.

I'm definitely not going to advocate returning to the Bourne shell
behavior, but it seems to me the security hole here is accepting IFS
from the environment, rather than the silly splitting that it does
when IFS is changed.

Thankfully, bash doesn't accept IFS from the environment.