<feed xmlns='http://www.w3.org/2005/Atom'>
<title>fscrypt.git/cmd/fscrypt/fscrypt_bash_completion, branch master</title>
<subtitle>Go tool for managing Linux filesystem encryption
</subtitle>
<link rel='alternate' type='text/html' href='https://git.hodgden.net/cgit.cgi/fscrypt.git/'/>
<entry>
<title>bash_completion: fix command injection and incorrect completions</title>
<updated>2022-02-23T20:35:04+00:00</updated>
<author>
<name>Eric Biggers</name>
<email>ebiggers@google.com</email>
</author>
<published>2022-02-23T20:35:04+00:00</published>
<link rel='alternate' type='text/html' href='https://git.hodgden.net/cgit.cgi/fscrypt.git/commit/?id=fa1a1fdbdea65829ce24a6b6f86ce2961e465b02'/>
<id>fa1a1fdbdea65829ce24a6b6f86ce2961e465b02</id>
<content type='text'>
Mountpoint paths might be untrusted arbitrary strings; the fscrypt bash
completion script might need to complete to such strings.
Unfortunately, the design of bash completion places some major footguns
in the way of doing this correctly and securely:

   - "compgen -W" expands anything passed to it, so the argument to -W
     must be single-quoted to avoid an extra level of expansion.

   - The backslashes needed to escape meta-characters in the completed
     text aren't added automatically; they must be explicitly added.

Note that the completion script for 'umount' used to have these same
bugs (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=892179,
https://github.com/util-linux/util-linux/issues/539).

Fix these bugs in roughly the same way that 'umount' fixed them.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Mountpoint paths might be untrusted arbitrary strings; the fscrypt bash
completion script might need to complete to such strings.
Unfortunately, the design of bash completion places some major footguns
in the way of doing this correctly and securely:

   - "compgen -W" expands anything passed to it, so the argument to -W
     must be single-quoted to avoid an extra level of expansion.

   - The backslashes needed to escape meta-characters in the completed
     text aren't added automatically; they must be explicitly added.

Note that the completion script for 'umount' used to have these same
bugs (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=892179,
https://github.com/util-linux/util-linux/issues/539).

Fix these bugs in roughly the same way that 'umount' fixed them.
</pre>
</div>
</content>
</entry>
<entry>
<title>bash-completion: add completion script</title>
<updated>2020-11-30T21:49:06+00:00</updated>
<author>
<name>Henry-Joseph Audéoud</name>
<email>henry-joseph.audeoud@univ-grenoble-alpes.fr</email>
</author>
<published>2020-10-30T10:41:52+00:00</published>
<link rel='alternate' type='text/html' href='https://git.hodgden.net/cgit.cgi/fscrypt.git/commit/?id=b74cd30fd7b0ebf30ef570f7bfa78dfcd62d80d5'/>
<id>b74cd30fd7b0ebf30ef570f7bfa78dfcd62d80d5</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
</feed>
