0

I'm working with a tool that uses a whitelist to allow certain commands to be executed. The whitelist works using file paths like so:

  • command1=/bin/echo
  • command2=/bin/sed
  • ...

The problem is commands like sed and grep are rejected by the whitelist if any regex expressions are used. Is there an executable associated with the regex engine that needs to be whitelisted here?

5
  • 1
    No. Matching regular expressions is either built into the executable (for historical reasons) or loaded from a shared library. Fix the "are rejected by the whitelist if any regex expressions are used" problem instead
    – waltinator
    Feb 8, 2022 at 3:18
  • Thanks. Do you have any idea why this might be happening? Unfortunately I don't have access to the source code of the tool and documentation is lacking.
    – cdbuzz17
    Feb 8, 2022 at 3:36
  • What do you mean by "if any regex expression is used"? foo is a regexp. is grep foo rejected? Is sed /foo/d rejected? Is sed s/foo/bar/g rejected? Is echo foo rejected? How is it rejected? Or is it that some strings with some characters (like *?) are rejected, or don't work as expected? Feb 8, 2022 at 6:25
  • "if any regex expressions are used" What do you mean by that?
    – Kusalananda
    Feb 8, 2022 at 7:33
  • @StéphaneChazelas The examples you provided all work correctly. If any special characters are used e.g. grep ^foo the tool rejects the input with the error "Command not in whitelist." If I disable the whitelist feature, all commands run successfully. I suspect the issue is some internal parsing error.
    – cdbuzz17
    Feb 8, 2022 at 23:28

1 Answer 1

-1

To the best of my knowledge, sed and grep implement their own regular expression engines. Browsing their source repositories, I see sed has regexp.c, for instance.

There are many implementations of sed and grep, so the precise answer may vary depending on which one you're using, but in general, there probably isn't a regular expression executable to whitelist. Thanks to commenters for correcting me.

3
  • There are countless implementations of sed and grep, your link seems to be pointing to the GNU implementation of sed. The OP didn't mention they were on a GNU system (though even GNU systems often have more than one sed implementations like the GNU and busybox ones) Feb 8, 2022 at 4:37
  • True and good point.
    – Dylan L
    Feb 8, 2022 at 6:21
  • sed and grep arguably do not implement regular expression engines but instead use the system's regular expression libraries.
    – Kusalananda
    Feb 8, 2022 at 8:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .