I'm also obligated by full disclosure to point out
the reason (a CVE a few years back) why '~' (and other
characters) were not included in rpm Version: strings.
Many scripts/tools construct shell commands using
values in metadata: rpmbuild is one of those tools,
there are others.
E.g. rpmbuild removes the build tree whose name is constructed
from NVR tags in metadata. Consider this *.spec metadata:
Name: N
Version: V~whatever
Release: R
from which data rpmbuild constructs a command
rm -rf N-V~whatever
preparing for a build.
All that is needed to trick rpmbuild into removing
one's home directory is an alternative representation
for a space character in some shell context surrounding
the twiddle so that the command becomes
rm -rf N-V ~ whatever
A closely related exploit that appended ";rm -rf ~" to
the Name: value (but using alternative representations of
the ' ' character was reported to vendor-sec like 4 years ago
I'm also obligated by full disclosure to point out
the reason (a CVE a few years back) why '~' (and other
characters) were not included in rpm Version: strings.
Many scripts/tools construct shell commands using
values in metadata: rpmbuild is one of those tools,
there are others.
E.g. rpmbuild removes the build tree whose name is constructed
from NVR tags in metadata. Consider this *.spec metadata:
Name: N
Version: V~whatever
Release: R
from which data rpmbuild constructs a command
rm -rf N-V~whatever
preparing for a build.
All that is needed to trick rpmbuild into removing
one's home directory is an alternative representation
for a space character in some shell context surrounding
the twiddle so that the command becomes
rm -rf N-V ~ whatever
A closely related exploit that appended ";rm -rf ~" to
the Name: value (but using alternative representations of
the ' ' character was reported to vendor-sec like 4 years ago