grep - Bugs: bug #32501, Manual page does not include a...
You are not allowed to post comments on this tracker with your current authentication level.
bug #32501: Manual page does not include a warning for GREP_OPTIONS
Submitter: | Igor Tarasov <tigr> | ||
Submitted: | Wed 16 Feb 2011 08:52:48 AM UTC | ||
Category: | None | Severity: | 3 - Normal |
Item Group: | None | Status: | Confirmed |
Privacy: | Public | Assigned to: | None |
Open/Closed: | Open |
Fri 15 Apr 2011 07:54:03 AM UTC, comment #4: |
Seungbeom Kim <musiphil> |
Mon 28 Feb 2011 08:39:14 AM UTC, comment #3: I agree with Igor. |
Paolo Bonzini <bonzini> |
Wed 16 Feb 2011 11:26:41 AM UTC, comment #2: Sure, but the problem is, only few scripts do this. In real-world applications this would break stuff in a very mysterious ways that would be really hard to debug for novice user. |
Igor Tarasov <tigr> |
Wed 16 Feb 2011 11:16:25 AM UTC, comment #1: It's really the responsibility of scripts to unset GREP_OPTIONS. Not doing so is often a security flaw, since you can change the behaviour of grep in all sorts of ways with GREP_OPTIONS. |
Reuben Thomas <rrt> |
Wed 16 Feb 2011 08:52:48 AM UTC, original submission:
Manual page should contain some kind of warning that specifying --color=always (via GREP_OPTIONS) system-wide might break some scripts. |
Igor Tarasov <tigr> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follows 1 latest change.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2011-02-28 | bonzini | Status | None | Confirmed |
Powered by Savane 3.13-3230.
Corresponding source code
I've been bitten by this too. -n is another option that seems nice and harmless on an interactive setting but that causes problems when the output is piped into a script.
Unsetting GREP_OPTIONS cannot be the responsibility of scripts, because there are already tons of old scripts that don't even know about GREP_OPTIONS. If scripts were required to defend themselves even in the presence of such environment variables, they would always have to start any serious work with an empty environment.
Security could be an issue if the program could be allowed to execute something not supposed to be executed, especially when the program is setuid as root, but it's not the case here; it's not a security flaw of grep per se.