Comment by emmelaich | Hacker News Reader

Comment by emmelaich | Hacker News Reader

Parent Full thread

I have a proposal. As an alternative to #!/bin/program I propose that

    #!program

is executed by using a program at a known location (or perhaps by following a system defined internal `PATH`) with a system cleaned or defined environment (e.g. PATH=/bin:/usr/bin and a TERM matching [a-zA-Z0-9-]+

This would fix a lot of this shellshock nonsense and also be a better alternative to the #!/bin/env hack for finding programs at different locations on different systems.

Programs should use args for communicating.

Extended syntax for programs to declare that they really need certain environment variables:

    #!program env=WHITELIST OF ENV VARS ALLOWED

This would have done nothing to prevent shellshock; placing user submitted data placed in ENVVARs is 'working as intended' for CGI, DCHPCP, etc.

Yes, with the whitelist (any whitelist) it would not have stopped shellshock. But having a whitelist would at least make them think about what they use which might help prevent other vulnerabilities.

I could propose that the whitelist be parsed before handing to any program. But that would be putting a potentially expensive and difficult job in a higher privileged place.

I think the rest is worth considering though.

  $ env -i WLIST=$WLIST WLIST2=$WLIST2 command

I've been meaning to ask ... why have all the examples for shellshock used `env`? Without even an -i?

My guess is that the unadorned `ONESHOTENVVAR=1 someprogram` is a little obscure to some. As to the lack of -i; it almost certainly necessary makes no difference to the result.

Using env may be slightly more portable if you're using an exotic login shell that doesn't support the "FOO=1 program" syntax - say, tcsh.

But for most part, it's probably just people copying-and-pasting stuff without really figuring it out what it does. For example, compare "exploit #1" and the supposedly different "exploit #3" on shellshocker.net.

Reply on news.ycombinator.com