Stories
Slash Boxes
Comments

SoylentNews is people

rm -rf / Considered Harmful, to Steam Users

posted by LaminatorX on Friday January 16 2015, @01:55PM   Printer-friendly
from the no-shortcuts dept.

FatPhil writes:

If you're a Steam user — beware, even slight modifications of your system may result in the nuking of your home directory, and more!

Fortunately, as the entry point for the user is a shell script (bash, but that's another story), it's been quite easy to find the source of the problem, the lack of sanitising shell variables before passing them to potentially dangerous commands — in this case, “rm -rf "$STEAMROOT/"*'”. The commit that introduced the bug also seems to have contained a remarkably apt comment ``#Scary!'' (it's not clear that the repo being pointed to, and its commits, mirror exactly the same commits as Steam themselves would have added them.)

It seems that even on MS Windows, Steam gets a bit over-eager about deleting files it doesn't own.

As a software engineer, who's also been a package maintainer on huge projects with up to 70 engineers wanting to force patches into my tree, I've become hyper-attuned to the concept of asking "what could possibly go wrong" (and having a mindset like Bob the Bastard from the animated Dilbert series), and consequently for demanding small readable patches which do just one small thing that's trivial to review. Would the patch have passed review? How confident are you about the quality of the rest of the code if things like this can slip through?

 
This discussion has been archived. No new comments can be posted.
rm -rf / Considered Harmful, to Steam Users | Log In/Create an Account | Top | 29 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 2) by Thexalon on Friday January 16 2015, @05:19PM

    by Thexalon (636) on Friday January 16 2015, @05:19PM (#135415)

    Bash certainly can cause trouble if you're acting as user "root" and relying on environment variables to specify the beginnings of directories. Believe me, I've FUBARed enough personal boxen to know exactly how bad it can get.

    That's why you shouldn't rely on external vars to be set, but actually, I dunno, check first before potentially deleting everything in the root directory.

    --
    The only thing that stops a bad guy with a compiler is a good guy with a compiler.
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  
    Total Score:   2  

  • (Score: 0) by Anonymous Coward on Friday January 23 2015, @05:06PM

    by Anonymous Coward on Friday January 23 2015, @05:06PM (#137317)

    I was with you until you used the word boxen. Please don't.

    Go ahead and try to look it up, the only definitions (that dont relate to boxwood) are user submitted. At best it is outdated jargon.