X-Recipient: archive-cygwin@delorie.com X-Spam-Check-By: sourceware.org Date: Sun, 5 Jul 2009 18:53:27 -0400 From: Christopher Faylor To: cygwin@cygwin.com Subject: Re: ssh-host-config eval password bug Message-ID: <20090705225327.GB2140@ednor.casa.cgf.cx> Reply-To: cygwin@cygwin.com Mail-Followup-To: cygwin@cygwin.com References: <4A50EBA3.9090000@gmail.com> <4A51200A.8090207@byu.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4A51200A.8090207@byu.net> User-Agent: Mutt/1.5.20 (2009-06-14) Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Delivered-To: mailing list cygwin@cygwin.com On Sun, Jul 05, 2009 at 03:50:02PM -0600, Eric Blake wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >According to Ian Kelling on 7/5/2009 12:06 PM: >> In the ssh package there is a bug in /usr/bin/ssh-host-config where if >> you select a valid password spaces or punctuation that bash knows of, it >> will fail and you could possibly shoot yourself in the foot due to >> evaling your password. I don't know who is responsible, or what mailing >> list to post on, but here is a patch. > >This is the right list. > >> - cygwin_env="-e CYGWIN=\"${csih_cygenv}\"" >> + cygwin_env=( -e "CYGWIN=${csih_cygenv}" ) > >I don't see why you need an array variable. > >> fi >> if [ -z "${password}" ] >> then >> - if eval cygrunsrv -I sshd -d \"CYGWIN sshd\" -p /usr/sbin/sshd \ >> - -a "-D" -y tcpip ${cygwin_env} >> + if cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd \ >> + -a "-D" -y tcpip "${cygwin_env[@]}" > >The eval is still reasonable, but with proper quoting: > >if eval cygrunsrv ... -y tcpip "${cygwin_env}" How is eval better than an array environment variable? The above use of "${cygwin_env[@]}" seems to do exactly what you'd want without worrying about the additional gotchas from an eval. cgf -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple