Bug#585552: crontab should not accept all control characters

2010-06-15 Thread Christian Kastner
On 06/15/2010 10:12 PM, vladz wrote: > As '%' is transformed into newline (in do_command.c), what do you think > about transforming other chosen characters (as for example '@', '~') into > carriage return and backspace control characters ? This could allow us to > disallow the use of '\r' and '\b'

Bug#585552: crontab should not accept all control characters

2010-06-15 Thread vladz
Hi, On Fri, Jun 11, 2010 at 09:09:44PM +0200, Christian Kastner wrote: > Say you want to run a program that requires those chars as input at some > point. If we refuse '\r' and '\b', then there would be no way to feed > those to that program. Ok, I see what you mean and you're right. > I need

Bug#585552: crontab should not accept all control characters

2010-06-11 Thread Christian Kastner
On 06/11/2010 07:32 PM, vladz wrote: > On Fri, Jun 11, 2010 at 06:30:29PM +0200, Christian Kastner wrote: >> I may be wrong, but I consider this only a minor problem. > > Yes it is. > >> 1) the job is still logged to syslog >> 2) the user does not have elevated permissions > > Right, I was j

Bug#585552: crontab should not accept all control characters

2010-06-11 Thread vladz
On Fri, Jun 11, 2010 at 06:30:29PM +0200, Christian Kastner wrote: > I may be wrong, but I consider this only a minor problem. Yes it is. > 1) the job is still logged to syslog > 2) the user does not have elevated permissions Right, I was just thinking of someone who want to keep the control

Bug#585552: crontab should not accept all control characters

2010-06-11 Thread Christian Kastner
On 06/11/2010 05:05 PM, vladz wrote: > Package: cron > Version: 3.0pl1-105 >=20 > It is possible to hide scheduled tasks inside a cron table by using con= trol > characters '\r' and '\b', example: >=20 > $ crontab -l > no crontab for alice >=20 > $ printf "* * * * * >/tmp/x;\rno crontab for alic

Bug#585552: crontab should not accept all control characters

2010-06-11 Thread vladz
Package: cron Version: 3.0pl1-105 It is possible to hide scheduled tasks inside a cron table by using control characters '\r' and '\b', example: $ crontab -l no crontab for alice $ printf "* * * * * >/tmp/x;\rno crontab for alice\n" | crontab - // new task (">/tmp/x") is hidden because of