find: Unusual Characters in File Names
3.3.2.3 Unusual Characters in File Names
........................................
As discussed above, you often need to be careful about how the names of
files are handled by 'find' and other programs. If the output of 'find'
is not going to another program but instead is being shown on a
terminal, this can still be a problem. For example, some character
sequences can reprogram the function keys on some terminals. ⇒
Security Considerations, for a discussion of other security problems
relating to 'find'.
Unusual characters are handled differently by various actions, as
described below.
'-print0'
'-fprint0'
Always print the exact file name, unchanged, even if the output is
going to a terminal.
'-ok'
'-okdir'
Always print the exact file name, unchanged. This will probably
change in a future release.
'-ls'
'-fls'
Unusual characters are always escaped. White space, backslash, and
double quote characters are printed using C-style escaping (for
example '\f', '\"'). Other unusual characters are printed using an
octal escape. Other printable characters (for '-ls' and '-fls'
these are the characters between octal 041 and 0176) are printed
as-is.
'-printf'
'-fprintf'
If the output is not going to a terminal, it is printed as-is.
Otherwise, the result depends on which directive is in use:
%D, %F, %H, %Y, %y
These expand to values which are not under control of files'
owners, and so are printed as-is.
%a, %b, %c, %d, %g, %G, %i, %k, %m, %M, %n, %s, %t, %u, %U
These have values which are under the control of files' owners
but which cannot be used to send arbitrary data to the
terminal, and so these are printed as-is.
%f, %h, %l, %p, %P
The output of these directives is quoted if the output is
going to a terminal. The setting of the 'LC_CTYPE'
environment variable is used to determine which characters
need to be quoted.
This quoting is performed in the same way as for GNU 'ls'.
This is not the same quoting mechanism as the one used for
'-ls' and 'fls'. If you are able to decide what format to use
for the output of 'find' then it is normally better to use
'\0' as a terminator than to use newline, as file names can
contain white space and newline characters.
'-print'
'-fprint'
Quoting is handled in the same way as for the '%p' directive of
'-printf' and '-fprintf'. If you are using 'find' in a script or
in a situation where the matched files might have arbitrary names,
you should consider using '-print0' instead of '-print'.
The 'locate' program quotes and escapes unusual characters in file
names in the same way as 'find''s '-print' action.
The behaviours described above may change soon, as the treatment of
unprintable characters is harmonised for '-ls', '-fls', '-print',
'-fprint', '-printf' and '-fprintf'.
Info Catalog
find: Safe File Name Handling
find: Multiple Files
find: Limiting Command Size