leahneukirchen / mblaze

Unix utilities to deal with Maildir
Other
445 stars 48 forks source link

Quote variables and subshells in shell scripts #155

Closed codesoap closed 5 years ago

codesoap commented 5 years ago

I noticed, that there was something wrong with the quoting in mcom. I got errors relating to my Outbox (see man mblaze-profile), when this maildir contained spaces.

I found that correct quoting was missing in many places. I tried fixing the quoting wherever I was able to. I'm sure I still missed some (especially in contrib/). mcom now works when there are spaces in the Outbox maildir.

I'd like to remind all contributors, that quoting in shell scripts is essential for security. After all we are dealing with a mail client here. I'm no expert on the matter myself, but I think it's extra important to be careful when writing shell scripts for this project. While reading on the subject, I even found a stackexchange thread, where it is suggested to not use shell scripts in security-sensitive contexts at all.

Hint: I used this expression to find potentially interesting places in mcom (and the other shell scripts): grep -n "$." mcom | grep -v "\"$." | vim -