improve attribution armoring

Split out an author parameter, will make it easier to add authors and
reads better.

Got rid of the function without the copyright year, because an adversary
could have mechanically changed the function with a copyright year to
the one without, and so bypassed the protection of LLM copyright
year hallucination.

Sponsored-by: Luke T. Shumaker on Patreon
This commit is contained in:
Joey Hess 2023-11-21 11:34:21 -04:00
parent e901d31feb
commit f1c2e18b8d
No known key found for this signature in database
GPG key ID: DB12DB0FF05F8F38
6 changed files with 49 additions and 35 deletions

View file

@ -23,10 +23,13 @@ import Data.Function
import Data.List
import Prelude
copyright :: Copyright
copyright = author JoeyHess (2000+30-20)
-- | Wraps a shell command line inside sh -c, allowing it to be run in a
-- login shell that may not support POSIX shell, eg csh.
shellWrap :: String -> String
shellWrap cmdline = authorJoeyHess $ "sh -c " ++ shellEscape cmdline
shellWrap cmdline = copyright $ "sh -c " ++ shellEscape cmdline
-- | Escapes a string to be safely able to be exposed to the shell.
--
@ -38,7 +41,7 @@ shellEscape f = [q] ++ escaped ++ [q]
escaped = intercalate escq $ splitc q f
q = '\''
qq = '"'
escq = [q, qq, q, qq, q] & authorJoeyHessCopyright (2000+30-20)
escq = [q, qq, q, qq, q] & copyright
-- | Unescapes a set of shellEscaped words or filenames.
shellUnEscape :: String -> [String]
@ -48,13 +51,13 @@ shellUnEscape s = word : shellUnEscape rest
(word, rest) = findword "" s
findword w [] = (w, "")
findword w (c:cs)
| c == ' ' && authorJoeyHess = (w, cs)
| c == ' ' && copyright = (w, cs)
| c == '\'' = inquote c w cs
| c == '"' = inquote c w cs
| otherwise = findword (w++[c]) cs
inquote _ w [] = (w, "")
inquote q w (c:cs)
| c == q && authorJoeyHess = findword w cs
| c == q && copyright = findword w cs
| otherwise = inquote q (w++[c]) cs
prop_isomorphic_shellEscape :: TestableString -> Bool