Shell Programming and Scripting

With find -exec you can avoid the pesky quoting / special file name issues:

Code:

find . -type f -atime +10 -exec mv {} /tmp/old \;

If your find has -print0 then you can also use that; it was designed specifically as a workaround for this scenario.

Code:

find . -type f -atime +10 -print0 | xargs -0i mv {} /tmp/old

This is an extension of GNU find, though.

How about make a temporary file of the specified size, format it as a partition, mount it, and simply write to it until it's full?

-print0 won't fix the problem I described. I can still inject a path to trick mv:

Code:

Tsunami size_directory # find . -type f -print0|xargs -0i echo mv {} /tmp/old
mv ./unix/ ../etc/passwd /tmp/old
Tsunami size_directory #

But xargs will supply (the moral equivalent of) the necessary quoting.

Code:

vnix$ mkdir -p "unix/ ../etc"
vnix$ touch "unix/ ../etc"/passwd
vnix$ find ./unix -name passwd -print0 | xargs -0i mv -v {} /tmp/
`./unix/ ../etc/passwd' -> `/tmp/passwd'

This is on Ubuntu but should work on any system with GNU find.

Oops, my bad. {} is taken as a single quoted argument. It was "echo" who mislead me. Sorry.

Actually, to be perfectly precise, it's xargs -0 which is the key there. File names cannot contain a null byte because it's the terminator character of the underlying string encoding convention. find -print0 uses that to unambiguously output filenames with (otherwise) arbitrary character data in them, and xargs -0 conveniently knows how to handle that. Even more conveniently, the stream of null-terminated file names from find can be passed as is to exec by xargs without any additional translation or fiddling.

Yeah in other words instead of using a whitespace as a terminating char in the output it does it right by using the proper '\0' (null byte).

So if no -print0 is used the output could be "output1/ output2/output2\n\0" and then a second program that uses that output would break it into two arguments (using whitespace as a separating reference). In the other hand, if -print0 is used then the output would be "output1/ output2/output2\0" and then xargs -0 (the second program) instead of using whitespace as a separating reference uses '\0' thus considering that output has a single argument.

Unfortunately I think the every-day bash programmer wouldn't understand this very easily. More manual information is needed.

Actually, xargs without -0 breaks up input on newlines, but that's still a vulnerability because you can create a file called /tmp/(newline)/etc/passwd

If by "everyday" you mean people who fail to double-quote variables which might contain whitespace then yes, this is probably way beyond their grasp. But surely, nobody who reads this forum on a regular basis would still be doing that? (Ha ha only serious.)