bugGNU Parallel - Bugs: bug #66750, --unsafe?

 
 

bug #66750: --unsafe?

Submitter:  None
Submitted:  Tue 04 Feb 2025 12:57:48 PM UTC
Votes: 400
 
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Open
* Mandatory Fields

Post a Comment

Add a New Comment Rich Markup
   

Discussion

Jump to the original submission

Thu 13 Mar 2025 08:26:07 PM UTC, comment #6: 

Please revert.

This breaks user experience for just about everybody using their (non-English) native language in the file system.

Unicode is around as a standard since about 1990. During the last 15 years I reassured coworkers, friends & family that it is finally not a problem anymore to use umlauts, brackets, or even spaces in file and directory names. And now this is considered "--unsafe". Why? What exactly is the potential security exposure area you are trying to minimize?

Again: please revert.

Sebastian Hegler <shegler>
Mon 24 Feb 2025 03:16:26 PM UTC, comment #5: 

I would love to, but I don't know how to participate in that "mail listing" (never used this old thing tbh): clicking on the button for "reply via email to Ole Tange" does nothing, and that looks like the only way to participate.

But I don't really have anything to add to what I said, the problem with `--unsafe` is that it is mandatory [...] and not retrocompatible. If it was "xor" instead of "and", it would be ok.

If `--unsafe` was ignored by old versions of GNU parallel, it would work.
Or, if `--unsafe` was not mandatory to use for a folder e.g. "Download (1)/" (by making it a warning), it would work.

Also, if you don't want to make it into a warning (bc "people don't read warnings"), you could perhaps only accept safe $PWD until the user accept the unsafe behavior (like it is done with `parallel --citation`).

Clément <thebigbadboy>
Sun 23 Feb 2025 11:34:33 AM UTC, comment #4: 

I think you raise valid points.

Can I ask you to take part in the discussion: https://lists.gnu ... -02/msg00003.html

Ole Tange <tange>
Group administrator
Mon 17 Feb 2025 01:22:22 AM UTC, comment #3: 

I used GNU parallel for years, also in automated scripts and even distribute some of them.

A recent update now forces me to use '--unsafe', and it is quite common for a folder/path to have parenthesis for example (which is not allowed in "safe" mode).

> GNU Parallel tries to be conservative to avoid surprising results.

Well, by just looking at that last update, not at all, really.

I had a really bad surprise when I discovered that GNU parallel introduced '--unsafe', because it is
- mandatory to use for anything just a little bit exotic (e.g. parenthesis, or japanese)
- not retrocompatible: older versions of GNU parallel (e.g. 20240622) does not support the option '--unsafe' and they simply print help page and quit.

Adding a mandatory argument for not so uncommon paths, and older releases not supporting that same argument, is not conservative at all, imo.

Clément <thebigbadboy>
Sun 16 Feb 2025 10:25:58 AM UTC, comment #2: 

GNU Parallel tries to be conservative to avoid surprising                     
results. --unsafe will allow GNU parallel to run in environments           
and on input that are untested and thus may cause surprising results and even security issues, where an evil attacker can influence the results. Think attacks similar to Shellshock:                                    
https://en.wikipe ... ock_(software_bug)                          
       
If you are forced to use --unsafe all the time for something that is safe, it is time to file a bug report and have a discussion how to make your situation well tested and safe.                                        

Non-ascii chars in paths is one such situation. How can this be done safe?

Ole Tange <tange>
Group administrator
Tue 11 Feb 2025 08:22:53 PM UTC, comment #1: 

Archlinux too, same thing.

I am wondering: why would it be unsafe if $PWD is not [-a-z0-9_+,.%@:/= ] ?

Anonymous
Tue 04 Feb 2025 12:57:48 PM UTC, original submission:  

Hello.

I'm on Archlinux and GNU parallel's version is 20250122.
When I run parallel, I've got this messages.

>$ parallel --version
>parallel: Error: $PWD can only contain [-a-z0-9_+,.%@:/= ].
>parallel: Error: Use '--unsafe' to ignore this.


$PWD is consisted of Korean letters.
Do I have to use --unsafe alwalys?

Anonymous

 

Attached Files

This item currently has no attached files.

(Note: upload size limit is set to 4.0MiB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

 

Dependencies

This item does not depend on any other items.

No items depend on this one.

 

Mail Notification Carbon-Copy List

Carbon-Copy List
  • -email is unavailable- added by chowbok (Voted in favor of this item)
  • -email is unavailable- added by darose (Voted in favor of this item)
  • -email is unavailable- added by shegler (Posted a comment)
  • -email is unavailable- added by vejkse (Voted in favor of this item)
  • -email is unavailable- added by thebigbadboy (Posted a comment)
  • -email is unavailable- added by tange (Posted a comment)
  • -email is unavailable- added by thebigbadboy (Voted in favor of this item)
  •  

    Votes

    There are 400 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    History

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2025-03-25 darose Carbon-Copy- Added darose
    2025-02-17 vejkse Carbon-Copy- Added vejkse
    2025-02-11 thebigbadboy Carbon-Copy- Added thebigbadboy

    Back to the top

    Powered by Savane 3.16-11ef.
    Corresponding source code