[bug #19374] Insufficient quoting of PRUNEPATHS in updatedb

Follow-up Comment #6, bug #19374 (project findutils):


> -val=`echo $arg|sed 's/^[^=]*=\(.*\)/\1/'` || exit 71
> +val=`echo "$arg"|sed 's/^[^=]*=\(.*\)/\1/'` || exit 71

This seems correct, but should also be applied to the line before for
consistency:

-  opt=`echo $arg|sed 's/^\([^=]*\).*/\1/'`  || exit 71
+  opt=`echo "$arg"|sed 's/^\([^=]*\).*/\1/'`  || exit 71


> - for p in $PRUNEPATHS; do
> + for p in "$PRUNEPATHS"; do

This defeats the purpose of the for-loop, as this tries to check if any of
the paths in PRUNEPATHS ends on '/', while the patch would reduce that check
only to the last element (due to quoting into a single string).

I'd suggest to change this to:

-for p in $PRUNEPATHS; do
-    case "$p" in
-       /*/)   echo "$0: $p: pruned paths should not contain trailing slashes"
>&2
-              exit 1
-    esac
-done
+nl='
+'
+if echo "$PRUNEPATHS" | tr ' ' "$nl" | grep '[^/]/$' >/dev/null; then
+  echo "$0: $p: pruned paths should not contain trailing slashes" >&2
+  exit 1
+fi


> test -z "$PRUNEREGEX" &&
> -  PRUNEREGEX=`echo $PRUNEPATHS|sed -e 's,^,\\\(^,' -e 's,
,$\\\)\\\|\\\(^,g' -e 's,$,$\\\),'`
> +  PRUNEREGEX=`echo "$PRUNEPATHS"|sed -e 's,^,\\\(^,' -e 's,
,$\\\)\\\|\\\(^,g' -e 's,$,$\\\),'`

I see several problems in this area.

updatedb allows to define PRUNEREGEX as environment variable from outside,
and only uses the value of --prunepath if the former is unset.
Usually, options should override environment variables, not the other way
round.

Furthermore, PRUNEPATHS seems to be defined to allow already-expanded items
only.
If one wants to use regular expressions, then why not directly define
PRUNEREGEX from outside?

In that regard, it would maybe be better to introduce a --pruneregex option
which takes the final pruning expression for find(1).  It could still
override
any of PRUNEPATHS and --prunepaths value, but shouldn't do that silently.



    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?19374>

_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/