Re: [Bug-tar] Format-string warnings in 1.26

[Paul Eggert]

On 07/28/11 23:04, Daniel Macks wrote:
> It's a valid concern when the string being fed comes from a gettext 
> translation
> (or really anything else that derives from user-controllable data).

The comment in parentheses is valid, but the comment
about gettext is not.  If gettext is vulnerable to the
kind of manipulation you're suggesting, then GNU tar
is vulnerable even with the patches you sent in.

For example, there's no point to changing this line:

  fprintf (stderr, _("Valid arguments are:")); 

while leaving this line alone:

  fprintf (stdlis, _(" link to %s\n"), quotearg (st->link_name));

Any gettext-based attack that would work against the former, would
also work against the latter, and since we cannot change the latter
there's little point to cluttering up the code by changing
the former.

The proper way to address this concern lies within
gettext, not within every application that uses gettext.
Gettext can and should refuse to return a translation that is
printf-wise incompatible with the untranslated string.
NU gettext does this sort of checking, and that should be
good enough.  If it isn't, please let us know,
so that we can fix GNU gettext.