|
Mountpoint paths might be untrusted arbitrary strings; the fscrypt bash
completion script might need to complete to such strings.
Unfortunately, the design of bash completion places some major footguns
in the way of doing this correctly and securely:
- "compgen -W" expands anything passed to it, so the argument to -W
must be single-quoted to avoid an extra level of expansion.
- The backslashes needed to escape meta-characters in the completed
text aren't added automatically; they must be explicitly added.
Note that the completion script for 'umount' used to have these same
bugs (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=892179,
https://github.com/util-linux/util-linux/issues/539).
Fix these bugs in roughly the same way that 'umount' fixed them.
|
