hephaest0s/usbkill

Spaces in folders_to_remove can cause usbkill to nuke /

wandernauta opened this issue · 5 comments

wandernauta commented

On line 88, usbkill does a rm -rf for every folder_to_remove, passing the name without escaping it. This means that if you set folders_to_remove as follows...

folders_to_remove = [ "/home/wander/usbkill /" ]

...usbkill will happily do a rm -rf /home/wander/usbkill / as root, recursively deleting a directory that doesn't exist and then soldiering on with the file system root.

Deleted user commented

You may want to melt usbkill: https://github.com/hephaest0s/usbkill/blob/master/settings.ini#L25

But yes, usbkill should escape the path.

wandernauta commented

I might be wrong, but I don't think melt_usbkill will work correctly either if usbkill is inside a directory with a space in the name, as it only does a realpath(__file__), not an escape.

>>> os.path.realpath('/home/wander/usbkill /usbkill.py')
'/home/wander/usbkill /usbkill.py'

If I understand things correctly, this would cause usbkill to remove nothing (as neither argument to rm would exist).

Deleted user commented

Fixed: #59

wandernauta commented

Thanks!

hephaest0s commented

Same issue applies to files_to_remove
Now fixed in version 1.0-rc.1