- Thanks for digging that bug up. I could have sworn there was another
much longer treatment of the subject, but it's possible that I imagined
John - Thanks for taking a look.
I have been looking as well. So far, all the places I've found so far that use dots to join user IDs and other values are harmless, because of how the composite values are used.
UserList, values are retrieved the same way they are constructed, by concatenation. So this is not a problem.
ProblemSet, temporary files are named
"$fileName.$userID.tmp", but they are retrieved by construction, which is OK. (By the way, that use of the user ID has to go for unrelated reasons.)
Hardcopy, saved hardcopy files are named
"$courseName.$fileNameUser.$fileNameSet.$ext". This is not a problem, since the name is never read and parsed.
This is probably not complete, but it's all the places I could think of
where dots might be used along with user IDs. But it's a good sign that
all of these have turned out to be innocuous. Rob and Mike might have
more to say on the matter.
<| Post or View Comments |>