security – Is It Secure to Use Certain Pathnames in $PATH?

environment-variablesfilenamespathSecurity

Is using the following kinds of pathnames in $PATH a secure and good practice:

  • empty pathname.

    findutils manual says it is insecure if $PATH contains an empty pathname, and I wonder why?

    Is an empty pathname an absolute or relative pathname?

  • pathnames containing tilde or filename expansions.

    Can a user of $PATH always understand and perform tilde or filename expansions in $PATH like shell?

    If I set the value of PATH in a shell startup script such as ~/.profile, does it matter at all, given that a shell executes the startup file?

    I found one related to tilde expansion https://unix.stackexchange.com/a/154290/674

  • current working directory. See Is it safe to add . to my PATH? How come?

Thanks.

Best Answer

If there is an empty element in PATH this refers to '.' and can be seen as insecure.

If the dot or empty element at the end of the PATH, this is not highly insecure, since it would only hit if someone places a binary in a directory that uses a misspelled system binary name.

For CDPATH it is the other way round: it you do not have the dot or empty element, cd will not find subdirectories in the current directory.

The tilde inside a PATH string is not understood. This is why the POSIX standard requires to expand tilde sequences after a colon in the command line when a shell macro is assigned.

Regarding the text you added to your question after I answered: these tilde characters are expanded before the command is executed.