bugGNU Parallel - Bugs: bug #66750, --unsafe?

 
 

bug #66750: --unsafe?

Submitter:  None
Submitted:  Tue 04 Feb 2025 12:57:48 PM UTC
Votes: 300
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Thu 13 Mar 2025 08:26:07 PM UTC, comment #6: 

Please revert.

This breaks user experience for just about everybody using their (non-English) native language in the file system.

Unicode is around as a standard since about 1990. During the last 15 years I reassured coworkers, friends & family that it is finally not a problem anymore to use umlauts, brackets, or even spaces in file and directory names. And now this is considered "--unsafe". Why? What exactly is the potential security exposure area you are trying to minimize?

Again: please revert.

Sebastian Hegler <shegler>
Mon 24 Feb 2025 03:16:26 PM UTC, comment #5: 

I would love to, but I don't know how to participate in that "mail listing" (never used this old thing tbh): clicking on the button for "reply via email to Ole Tange" does nothing, and that looks like the only way to participate.

But I don't really have anything to add to what I said, the problem with `--unsafe` is that it is mandatory [...] and not retrocompatible. If it was "xor" instead of "and", it would be ok.

If `--unsafe` was ignored by old versions of GNU parallel, it would work.
Or, if `--unsafe` was not mandatory to use for a folder e.g. "Download (1)/" (by making it a warning), it would work.

Also, if you don't want to make it into a warning (bc "people don't read warnings"), you could perhaps only accept safe $PWD until the user accept the unsafe behavior (like it is done with `parallel --citation`).

Clément <thebigbadboy>
Sun 23 Feb 2025 11:34:33 AM UTC, comment #4: 

I think you raise valid points.

Can I ask you to take part in the discussion: https://lists.gnu.org/archive/html/parallel/2025-02/msg00003.html

Ole Tange <tange>
Group administrator
Mon 17 Feb 2025 01:22:22 AM UTC, comment #3: 

I used GNU parallel for years, also in automated scripts and even distribute some of them.

A recent update now forces me to use '--unsafe', and it is quite common for a folder/path to have parenthesis for example (which is not allowed in "safe" mode).

> GNU Parallel tries to be conservative to avoid surprising results.

Well, by just looking at that last update, not at all, really.

I had a really bad surprise when I discovered that GNU parallel introduced '--unsafe', because it is
- mandatory to use for anything just a little bit exotic (e.g. parenthesis, or japanese)
- not retrocompatible: older versions of GNU parallel (e.g. 20240622) does not support the option '--unsafe' and they simply print help page and quit.

Adding a mandatory argument for not so uncommon paths, and older releases not supporting that same argument, is not conservative at all, imo.

Clément <thebigbadboy>
Sun 16 Feb 2025 10:25:58 AM UTC, comment #2: 

GNU Parallel tries to be conservative to avoid surprising                     
results. --unsafe will allow GNU parallel to run in environments           
and on input that are untested and thus may cause surprising results and even security issues, where an evil attacker can influence the results. Think attacks similar to Shellshock:                                    
https://en.wikipedia.org/wiki/Shellshock_(software_bug)                          
       
If you are forced to use --unsafe all the time for something that is safe, it is time to file a bug report and have a discussion how to make your situation well tested and safe.                                        

Non-ascii chars in paths is one such situation. How can this be done safe?

Ole Tange <tange>
Group administrator
Tue 11 Feb 2025 08:22:53 PM UTC, comment #1: 

Archlinux too, same thing.

I am wondering: why would it be unsafe if $PWD is not [-a-z0-9_+,.%@:/= ] ?

Anonymous
Tue 04 Feb 2025 12:57:48 PM UTC, original submission:  

Hello.

I'm on Archlinux and GNU parallel's version is 20250122.
When I run parallel, I've got this messages.

>$ parallel --version
>parallel: Error: $PWD can only contain [-a-z0-9_+,.%@:/= ].
>parallel: Error: Use '--unsafe' to ignore this.


$PWD is consisted of Korean letters.
Do I have to use --unsafe alwalys?

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by darose (Voted in favor of this item)
  • -email is unavailable- added by shegler (Posted a comment)
  • -email is unavailable- added by vejkse (Voted in favor of this item)
  • -email is unavailable- added by thebigbadboy (Posted a comment)
  • -email is unavailable- added by tange (Posted a comment)
  • -email is unavailable- added by thebigbadboy (Voted in favor of this item)
  •  

    There are 300 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2025-03-25 darose Carbon-Copy- Added darose
    2025-02-17 vejkse Carbon-Copy- Added vejkse
    2025-02-11 thebigbadboy Carbon-Copy- Added thebigbadboy

    Back to the top

    Powered by Savane 3.14-962f.
    Corresponding source code