From owner-svn-src-all@freebsd.org Sat Oct 8 13:40:14 2016 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 776E3C05943; Sat, 8 Oct 2016 13:40:14 +0000 (UTC) (envelope-from jilles@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 3AAE3E5F; Sat, 8 Oct 2016 13:40:14 +0000 (UTC) (envelope-from jilles@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u98DeD5U088065; Sat, 8 Oct 2016 13:40:13 GMT (envelope-from jilles@FreeBSD.org) Received: (from jilles@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u98DeDxj088061; Sat, 8 Oct 2016 13:40:13 GMT (envelope-from jilles@FreeBSD.org) Message-Id: <201610081340.u98DeDxj088061@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: jilles set sender to jilles@FreeBSD.org using -f From: Jilles Tjoelker Date: Sat, 8 Oct 2016 13:40:13 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r306843 - in head/bin/sh: . tests/parameters X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Oct 2016 13:40:14 -0000 Author: jilles Date: Sat Oct 8 13:40:12 2016 New Revision: 306843 URL: https://svnweb.freebsd.org/changeset/base/306843 Log: sh: Do not import IFS's value from the environment. Per Austin group issue #884, always set IFS to $' \t\n'. As before, IFS will be exported iff it was in the environment. Most shells (e.g. bash, ksh93 and mksh) already did this. This change improves predictability, in that scripts can simply rely on the default value. However, the effect on security is little, since applications should not be calling the shell with attacker-controlled environment variable names in the first place and other security-sensitive variables such as PATH should be and are imported by the shell. When using a new sh with an old (before 10.2) libc wordexp(), IFS is no longer passed on. Otherwise, wordexp() continues to pass along IFS from the environment per its documentation. Discussed with: pfg Relnotes: yes Added: head/bin/sh/tests/parameters/ifs1.0 (contents, props changed) Modified: head/bin/sh/sh.1 head/bin/sh/tests/parameters/Makefile head/bin/sh/var.c Modified: head/bin/sh/sh.1 ============================================================================== --- head/bin/sh/sh.1 Sat Oct 8 13:38:05 2016 (r306842) +++ head/bin/sh/sh.1 Sat Oct 8 13:40:12 2016 (r306843) @@ -32,7 +32,7 @@ .\" from: @(#)sh.1 8.6 (Berkeley) 5/4/95 .\" $FreeBSD$ .\" -.Dd May 30, 2016 +.Dd October 8, 2016 .Dt SH 1 .Os .Sh NAME @@ -1349,13 +1349,13 @@ used in tilde expansion and as a default built-in. .It Va IFS Input Field Separators. -The default value is +This is initialized at startup to .Aq space , .Aq tab , and .Aq newline in that order. -This default also applies if +This value also applies if .Va IFS is unset, but not if it is set to the empty string. See the Modified: head/bin/sh/tests/parameters/Makefile ============================================================================== --- head/bin/sh/tests/parameters/Makefile Sat Oct 8 13:38:05 2016 (r306842) +++ head/bin/sh/tests/parameters/Makefile Sat Oct 8 13:40:12 2016 (r306843) @@ -9,6 +9,7 @@ ATF_TESTS_SH= functional_test ${PACKAGE}FILES+= env1.0 ${PACKAGE}FILES+= exitstatus1.0 +${PACKAGE}FILES+= ifs1.0 ${PACKAGE}FILES+= mail1.0 ${PACKAGE}FILES+= mail2.0 ${PACKAGE}FILES+= optind1.0 Added: head/bin/sh/tests/parameters/ifs1.0 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/bin/sh/tests/parameters/ifs1.0 Sat Oct 8 13:40:12 2016 (r306843) @@ -0,0 +1,10 @@ +# $FreeBSD$ + +env IFS=_ ${SH} -c ' +rc=2 +nosuchtool_function() { + rc=0 +} +v=nosuchtool_function +$v && exit "$rc" +' Modified: head/bin/sh/var.c ============================================================================== --- head/bin/sh/var.c Sat Oct 8 13:38:05 2016 (r306842) +++ head/bin/sh/var.c Sat Oct 8 13:40:12 2016 (r306843) @@ -186,6 +186,7 @@ initvar(void) } } setvareq_const("OPTIND=1", 0); + setvareq_const("IFS= \t\n", 0); } /*