Hacker News Reader

Comment by mikece | Hacker News Reader

"This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names."

Perhaps I don't get this because I have used Windows most of my life (and DOS before that) but is it valid to have newline characters in a Unix/Linux filename?

View on HN

Unix filesystems can typically have filenames containing any bytes except "\0" and "/".

I believe you can also have newline characters in NTFS, although Windows Explorer appears to prevent creating a file with them.

I have been using the filename "meeting-notes:10/1 \n Unix & Windows.txt" to test various apps. It tends to expose just how brittle modern computing still is.

I made a whole collection: https://github.com/benibela/nasty-files

"--no-preserve-root" made me laugh. for testing unescaped calls to rm?

It's a bypass against a mitigation for an old trick which worked back in the day where you could watch someone self-nuke themselves off of IRC by convincing them to type rm -rf /

It is to mess with people calling rm * / in the directory

Good thing there is not really any reason to call rm like that

oh does that actually work? the * expanding a filename to an argument? I guess it all just ends up in argv

Oh cool! I use nasty-files as a submodule with some of my tests. I can't believe how long I went without without testing against the filename corner cases.

I've found so much software that doesn't properly handle nasty filenames, I think it should be tested for more.

Lol that broke git for me

There are no rules about what can be in a filename except they can't contain \0 or / as a matter of practice because the kernel interprets these as end of string and path element separator, respectively.

For even more fun NTFS filenames can actually have newlines in them if you access them with \\?\.

Good to know. :)

Another "queer" naming issue in Windows (JFYI), backslash and ALT+0160:

https://msfn.org/board/topic/131103-win_nt~bt-can-be-omitted...

https://superuser.com/questions/129519/which-file-systems-su...

So yea, it looks like that linux filesystems accept this, but a lot of utilities break.

Reply on news.ycombinator.com