Re: 8-bit patch for zle_tricky.c

[Zefram <A.Main@xxxxxxxxxxxxxxxxx>]

>Yes, the original Bourne Shell used IFS in the lexer to separate words but
>I think that this does not conform the POSIX Shell and Utilities standard.

It's been a while since I read the standard, and I don't have access to
a copy any more, but I'm pretty sure it's required.  I needed to check
this particular matter for some reason.  Can someone with a POSIX shell
or the standard check this?

>Also it may be a security hole if IFS is exported.  That's why bash and
>ksh does not use IFS here, and zsh should not use it either.

It is a security hole, but (a) setuid shell scripts are insecure anyway
on most systems, and (b) there's a way to avoid it:

#!/bin/sh
IFS=' 	
'
echo Note that IFS is now safe.

The above, as a shell script, is secure if setuid on, for example,
Solaris.  Anyone writing setuid scripts should know this technique.

Another solution would be to remove sensitive parameters such as IFS
and LD_* on initialisation if the PRIVILEGED option is set (euid !=
ruid).  Note that a script can already totally clear the exported
environment by doing `typeset +x -m \*`.

-zefram