Re: [SLUG] PATH=$PATH.

[John Ferlito <johnf@nospam.inodes.org>]

On Sat, May 27, 2000 at 09:15:31PM +0000, Minh Van wrote:
> can i execute binary files in the $PWD first without having to have $PWD
> in $PATH ? or do i have to source a function in bashrc ? the best thing i
> can think of that suits my purpose is "PATH=$PATH:.".
> 
	
	The main problem with having . in your path is of course security.
Best is example is if you have . in your path and I put a file in /tmp that
looks like this

#!/bin/sh
cd $HOME
rm -rf *

Then go cd into /tmp and run ls well pretty disastorous things are going to happen.
Some people will tell you that putting the dot at the end of your path is safe because 
the ls in /bin will get run first. But how many times do you accidently time la instead 
of ls, or maybe you've been using DOS to long and start typing commands like copy by accident.
I can just rename my evil script to do something like that.

> apparently people think this style is dangerous and promotes bad habits.
> but i don't understand why this style is different to putting scripts in
> $PATH and being able to run them.

	The difference here is that if you put $HOME/bin in your path you should be the
only person with permissions to write scripts in that directory so you can't do the /tmp 
trick.

> 
> there was also another suggestion that i got from people, and that was to
> use "PATH=$PATH:.." ie. two with "."s.

	That will put $PWD/.. in your path ie the parent directory, probably not
very useful and just as dangerous.

> 
> i've also conducted my own tests for "PATH=$PATH:./", which seems to do
> the same thing.

	Same as dot just as dangerous.

	You basically need to decide wether it's safe to put . in your path. If it's on a
machine that only you use at home then it's probably not too much of a problem unless somebody
hacks into your box but then you've got bigger problems :) But it will possibly lead to bad habits 
and when you move to a public box you'll get annoyed with not having it and put it in anyway.

	Besides it's not that hard to type ./ in front of commands not in your path is it?

PGP signature