Beefy Boxes and Bandwidth Generously Provided by pair Networks
Just another Perl shrine
 
PerlMonks  

Re^4: Getting information about a remote file via SSH: how to escape the filename

by salva (Monsignor)
on Jun 27, 2013 at 14:46 UTC ( #1041030=note: print w/ replies, xml ) Need Help??

Comment on Re^4: Getting information about a remote file via SSH: how to escape the filename
Re: Getting information about a remote file via SSH: how to escape the filename
by jonadab (Parson) on Jun 27, 2013 at 16:15 UTC
    How can you discern a valid filename from a malicious one in a generic way?

    More to the point, if a file has a name that would cause problems using that approach (e.g., because it has quotation marks in it), I still want to get the information about that file from the remote server.

Re^5: Getting information about a remote file via SSH: how to escape the filename
by Happy-the-monk (Monsignor) on Jun 27, 2013 at 16:44 UTC

    How can you discern a valid filename from a malicious one in a generic way?

    I probably couldn't.

    I actually haven't seen an attack through malicious filenames in 20 years.
    *knock on wood*

    The olden days war story goes along the lines of files containing unix brand conforming line breaks followed by commands. Those were aimed at the habit of some superuser types using scripts with xargs(1) for file system tidyup tasks or such and ending up with unwanted command execution. I find I don't remember that very well.

    Generally I'd prefer my file names to contain [\w.-] exclusively... the world out there please hear my wishful plea :-)

    Cheers, Sören

    (hooked on the Perl Programming language)

Re^5: Getting information about a remote file via SSH: how to escape the filename
by Happy-the-monk (Monsignor) on Jun 27, 2013 at 17:55 UTC

    How can you discern a valid filename from a malicious one in a generic way?

    The OP has pointed out in his case, malicious file names would be unlikely,
    I found that most of the time there was quite the possibility to narrow down the range of allowed characters to minimum of less than 70, excluding most interpunctuation characters.and shell redirects and pipes, control characters and whitespace.

    But it is very good you mentioned it, as in a current project I find myself in a less fortunate position where I have to grok file names coming in through user input:
    the users are real users and the file system a windows ntfs in my particular case.

    Suggestions on how to stay safe are very welcome.

    Cheers, Sören

    (hooked on the Perl Programming language)

      Suggestions on how to stay safe are very welcome

      Avoid the shell as much as you can (i.e. using system $cmd, @args instead of system "$cms @args").

      Otherwise, quote your data properly. For instance, for POSIX shells I use the following sub to quote commands and arguments:

      my $glob_class = '*?\\[\\],{}:!^~'; sub quote { shift; my $quoted = join '', map { ( m|\A'\z| ? "\\'" : m|\A'| ? "\"$_\"" : m|\A[$noquote_class]+\z|o ? $_ : "'$_'" ) } split /('+)/, $_[0]; length $quoted ? $quoted : "''"; }

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://1041030]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others studying the Monastery: (14)
As of 2014-10-24 11:49 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    For retirement, I am banking on:










    Results (131 votes), past polls