Re: Arbitrary characters in filenames (was Re: Default PATH setting ...)

On 2025-01-27, Janis Papanagnou <janis_papanagnou+ng@hotmail.com> wrote:

Back these days someone had pointed out that it's actually helpful
if you have only few restrictions ('\0' and '/') on characters; it
makes it possible to support "non-ASCII file systems" based on that
underlying primitive design. - That's certainly a valid point.

Today, billions of people around the world have files named using their
native scripts.

The point (made upthread) with the non-ASCII slash character makes
me doubt, though. Wouldn't such exploits like you constructed with
the "literal '~'" topic be also possible with "fake" slashes?

Sure; say the user adds "/home/foo/bin" to their PATH, but somehow their
editor flips the slashes to the Unicode U+2215 slash, then it's just one
relative path component that is susceptible to hijack.

The user would have to somehow not notice that their /home/bin/foo PATH
element is not actually working: programs in that directory are not
being found.

If the shell did something silly, namely map Unicode slashes to ASCII
equivalents when doing its own procesing of PATH, then that user would
be fooled into thinking that the path component is correct.

That's kind of what Bash is doing with the tilde; for its own purposes,
it's turning, in the leading position, a dumb tilde into a smart tilde,
which we can almost regard as different characters.

--
TXR Programming Language: http://nongnu.org/txr
Cygnal: Cygwin Native Application Library: http://kylheku.com/cygnal
Mastodon: @Kazinator@mstdn.ca