alt Hacker News> "Tailscale SSH now rejects usernames with leading dashes."
Really? That's the fix?
A proper fix is to use "--" to separate arguments.
Replies
catlifeonmars • today at 4:51 AM
“--“ doesn’t work on all versions of getent.
A better fix is to call “getent passwd” with no user controlled arguments and then parse the resulting list. This gets rid of the input sanitization problem entirely.
➕ show 1 reply
sedatk • today at 1:54 AM
Their fix just future-proofs it in case the same bug gets reintroduced.
➕ show 2 replies
A proper fix is not to shell out to a command at all; use getpwnam(3) or similar.