Re busybox tar hidden filename exploit

[Steffen Nurpmeso]

Kang-Che Sung wrote in
 <CADDzAfOSM_MYLySY8nObOkac4rs1k_Lo6kTffWNveF5rdAagKw at mail.gmail.com>:
 ...
 |When it comes to unusual filenames, the GNU way of doing it is implementing
 |a `--null` option that accepts the list of filenames separated by ASCII NUL
 |characters.
 |
 |Various other utilities can print the filename list with NUL as the
 |separator. For example `-print0` command in `find(1)`.

This (at least, too lazy to look) is also part of the new POSIX
standard released in June.  Ie, going that NUL thing seems "to
come", it *could* be that there are other issues lying around for
the next standard.

  ...

(Nonetheless quoting in the shell language is a must

  80092          The application shall quote the following characters if they are to represent themselves:
  80093          |    &     ;    <    >   (    )    $    `    \     "    '    <space>         <tab>          <newline>

and POSIX 2024 adds the $'' dollar single quote mechanism (dash is
about to implement it / has just recently done so), and for tools
producing output for the (interaction with the) shell that thus
seems useful to have; i do not know how portable "IFS= xy" is..)

--steffen
|
|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)