security considerations for: set x dir/[*] dir/*

set x ${dir?}/[*] ${dir?}/*

is a usefull construct to prepare an iteration over all files in a
directory ${dir}, taking into account the cases where ${dir} is empty
or contains a file with name *. I suspect that one can also use --
instead of the x, but I am not sure.

The following steps for the iteration are:

shift &&
case "${1?} ${2?}" in
${dir?}/\[\*\]\ ${dir?}/\*) return 0 ;;
*) : ;;
esac &&
shift &&
while test "$#" -ge 1; do
{
# ... do something with $1 ...
shift
} || return "$?"
done

This does not use any variables, apart from ${dir} and the positional
parameters. This is usefull in order to put this construct into a
general-purpose shell function, for shells that do not support local
variables.

However, I am not yet convinced 100% that this is secure in case the
contents of ${dir} is under the control of an attacker (and this shell
construct runs with some higher privileges). The x in the call to set
should prevent any surprises triggered by funny filenames, I guess.
Maybe someone likes to comment on this? Have I missed something?

Regards, Lasse
.

Relevant Pages

  • Re: security considerations for: set x dir/[*] dir/*
    ... taking into account the cases where $is empty ... The following steps for the iteration are: ...
    (comp.unix.shell)
  • Re: bit operations and parity
    ... Only one shift is needed per iteration, so there are no questions about whether the processor has a barrel shifter. ... exercise for the reader. ... (Extending it to float and double is left ...
    (comp.lang.java.programmer)
  • Re: circular shifting a vector/matrix - Problem
    ... corrCoef = zeros(1, numColMatrix01); ... for shiftSize = 1:numColMatrix01, ... Are you sure you want to shift like this (iteration 1, 1 shift, ...
    (comp.soft-sys.matlab)
  • Re: bit operations and parity
    ... Mayeul wrote in ... The table could be computed offline and stored in the source code, ... for the shift at the end of each iteration. ...
    (comp.lang.java.programmer)
  • Re: Position of title changes in each loop. Why?
    ... So I expect titleposition to be the ... You are shifting the title slightly up in each iteration. ... I assume you are plotting on the same axis in each loop. ... You only need to shift it once. ...
    (comp.soft-sys.matlab)