[Bug 295428] Installer: root password truncates to 32 characters

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295428

--- Comment #8 from Devin Teske <dteske@FreeBSD.org> ---
I hate to also bring it up, but there's a security violation in the code too.
The results of which are a denial of service at best, possibly worse.

I am guilty of this too, and I will endeavor to fix this where I see it, but
allow me to point out:

https://cgit.freebsd.org/src/tree/usr.sbin/bsdinstall/scripts/rootpass#n40

```
: ${BSDDIALOG_OK:=0}
```

Should be:

```
: "${BSDDIALOG_OK:=0}"
```

And allow me to explain why this is a security issue.

Without double-quotes, a pre-assigned value that is inherited by export prior
to invocation that contains globs can hang the command nearly indefinitely.
Allow me to demonstrate with an example code:

1. Go into proper shell with tracing enabled: sh -x
2. Set a poison value containing globs: foo="/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*
/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/* /*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*
/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/* /*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*"
3. Confirm that quoting the expansion is safe: echo "$foo"
4. Confirm that unquoting is unsafe: echo $foo
5. Confirm that : is no different than echo: : ${foo:=bar}

NB: Without tracing enabled (sh -x or sh then set -x) you'll just see the hang.
With tracing enabled, you'll see how the glob is expanded into positional
arguments to echo or :

So if someone or something either accidentally or maliciously exports a poison
value, then the parameter expansion to assign a default value for when the
variable is NULL or unset acts as a form of denial-of-service not-only due to
the delay (which can be substantial on a system with many files) but also in
ramping filesystem activity beyond reason

-- 
You are receiving this mail because:
You are the assignee for the bug.