Path: utzoo!utgpu!watmath!clyde!att!rutgers!gatech!bbn!bbn.com!rsalz From: rsalz@bbn.com (Rich Salz) Newsgroups: news.admin Subject: The dangers of shell archives Message-ID: <1241@papaya.bbn.com> Date: 29 Nov 88 20:38:38 GMT References: <1227@vsi1.UUCP> <117@hudson.Morgan.COM> <1988Nov27.162018.22115@ateng.ateng.com> Organization: BBN Systems and Technologies Corporation Lines: 23 1>Er, yes. Rich Salz's "cshar" package includes a "safe" unshar program in C. 2>Hmm. Please point me at this. I looked through the cshar package [...] 2>The shell program runs commands, but is by no mean secure (see man page). 2>Which one, then, is secure? 1>I erred. Rich's shell isn't secure. 1>On the other hand, it wouldn't take much to make it safe -- such as, put a 1>halt to all shell scripts that make references to absolute pathnames. The shell interpreter that comes with my "cshar" package is definitely not secure. It'd be hard to do something that's VERY safe, but I am putting in checks for things like overwriting existing files, creating very long files, making too many files or directories, etc. If you've got some special checks you'd like to see done, let me know. My only concern is that people end up trusting the interpreter and someone will write a shar that still manages to hurt your system. I don't know when I'll get around to putting out the new release. /rich $alz -- Please send comp.sources.unix-related mail to rsalz@uunet.uu.net.