Re: GNU Sharutils and security

[Paul Eggert]

"Bruno Haible" <address@hidden> writes:

> Therefore, how about removing shar and unshar from the sharutils, or
> splitting sharutils into a useful and harmless package and a
> separate security -killer package?

Good suggestion.

Perhaps the simplest way would be to revert the November 1994 change,
which merged GNU shar 4.0 and GNU uuencode 1.0 into GNU sharutils 4.1.
We could, for example, rename GNU sharutils back to GNU uuencode and
bump the version number, thus removing shar and unshar.

If simply removing shar and unshar is considered to be too drastic,
another possibility is to substitute a "safer" unshar, which doesn't
actually invoke the shell, but which verifies the input and only does
"safe" things.  This would resemble the sort of security fixes that
have been installed into GNU tar over the past few years.

Once this is done, perhaps GNU shar should output scripts that start
like this:

#!/bin/sh
echo "Please do not use the shell to evalue this file; use GNU unshar instead."
echo "Otherwise you are leaving yourself wide open for security attacks"
echo "like Trojan horses, viruses, etc."
exit 1

However, all this would be some work (particularly the safer unshar).