Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I mean, yes I know how to quote and escape. My point was that only I know what my intent was. Do I want local shell interpretation, remote shell interpretation, awk interpretation or a literal string? I'm not sure how great an autoquoter is going to be if it doesn't know my intent. In the end, I'll need to do it myself, since I know what I want.

And the shame of that is that there aren't a lot of tools to help. Utility functions like shell_escape() would be nice, but you still need to handle escaping for the local shell. That's essentially true of any programming language.



> My point was that only I know what my intent was. [...] In the end, I'll need to do it myself, since I know what I want.

I think we're in violent agreement here; my point was that the autoquoter is superfluous, since the command in your previous comment already does what

> his (very cool) autoquoter [supposedly] allows

even without a autoquoter.

> Utility functions like shell_escape() would be nice

Note that in this case you specifically do not want shell_escape(). You're trying to produce awk code that evaluates to a given string, and that requires knowing awk syntax, not shell syntax; if you escape according to shell syntax, a attacker may be able to find a string where the shell expression for that string, when interpreted as awk code, does something other than evalute to a string.

You could have a generic_escape() function that (say) replaced any non-alphanumeric byte with '\xHH' or '\B' (for 'B'==0xHH), but there will always some language where whatever generic strategy you picked doesn't work.

  $ echo "\x3E"
  x3E  # shell doesn't accept \xHH
  $ echo '12+3<45' | grep -oE '\<.' | paste -sd' '
  1 3 4  # posix ERE doesn't accept \B




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: