X-Recipient: archive-cygwin AT delorie DOT com
X-SWARE-Spam-Status: No, hits=-1.8 required=5.0 	tests=AWL,BAYES_00,SPF_SOFTFAIL
X-Spam-Check-By: sourceware.org
Message-ID: <4A51200A.8090207@byu.net>
Date: Sun, 05 Jul 2009 15:50:02 -0600
From: Eric Blake <ebb9 AT byu DOT net>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.22) Gecko/20090605 Thunderbird/2.0.0.22 Mnenhy/0.7.6.666
MIME-Version: 1.0
To: cygwin AT cygwin DOT com
Subject: Re: ssh-host-config eval password bug
References: <4A50EBA3 DOT 9090000 AT gmail DOT com>
In-Reply-To: <4A50EBA3.9090000@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-IsSubscribed: yes
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

According to Ian Kelling on 7/5/2009 12:06 PM:
> In the ssh package there is a bug in /usr/bin/ssh-host-config where if
> you select a valid password spaces or punctuation that bash knows of, it
> will fail and you could possibly shoot yourself in the foot due to
> evaling your password. I don't know who is responsible, or what mailing
> list to post on, but here is a patch.

This is the right list.

> -      cygwin_env="-e CYGWIN=\"${csih_cygenv}\""
> +      cygwin_env=( -e "CYGWIN=${csih_cygenv}" )

I don't see why you need an array variable.

>      fi
>      if [ -z "${password}" ]
>      then
> -      if eval cygrunsrv -I sshd -d \"CYGWIN sshd\" -p /usr/sbin/sshd \
> -                -a "-D" -y tcpip ${cygwin_env}
> +      if cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd \
> +                -a "-D" -y tcpip "${cygwin_env[@]}"

The eval is still reasonable, but with proper quoting:

if eval cygrunsrv ... -y tcpip "${cygwin_env}"

- --
Don't work too hard, make some time for fun as well!

Eric Blake             ebb9 AT byu DOT net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Cygwin)
Comment: Public key at home.comcast.net/~ericblake/eblake.gpg
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkpRIAoACgkQ84KuGfSFAYAAZQCghGoY51fmSiEpxbAP3iRdmVuj
hEAAn3VxdXV8mSpRKG8j++35F9QQH8+6
=FYJ6
-----END PGP SIGNATURE-----

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple