Use ./*glob* or -- so files are not read as flags
A glob that matches a file like `-rf` becomes a deletion flag. Prefix with `./` or `--` to disarm it.
Problem
Globs expand to filenames, and filenames can start with `-`. A file named `-rf` in the current directory turns `rm *` into `rm -rf …`. This is a classic injection vector when scripts run in attacker-controlled directories.
Bad
rm *
chmod 644 *.confGood
rm -- *
chmod 644 -- *.conf
# Or anchor the glob:
rm ./*Explanation
`--` marks the end of options on most GNU and BSD utilities. `./` makes the path literal rather than option-like. Use whichever is clearer for your team and apply it consistently to every command that consumes globs.
When It Matters
A glob like *.txt expands to filenames, and a file named -rf.txt or --version.txt is then handed to the command as an option rather than an operand. With rm that is a genuine security problem — an attacker who can create files in a directory you clean up can inject flags into your command. The same trick affects grep, cp, tar, and anything else that parses leading dashes, and it is invisible in testing because normal filenames never trigger it.
Second Example
Note
The ./ prefix and the -- separator solve the same problem; the ./ form additionally makes the output of tools like grep unambiguous about relative paths.
Exceptions
If the glob is anchored to an absolute path — /var/log/*.log — every expansion already begins with a slash and cannot look like an option, so the warning does not apply. Some commands also do not accept --, in which case the ./ prefix is the portable answer.
Faq
Q
What does -- actually do?
A
It signals the end of options; everything after it is treated as an operand even if it starts with a dash. It is specified by POSIX for utilities that follow the standard syntax guidelines.
Q
Does ./ change the output of commands?
A
Yes, tools that echo the filename will print ./name.txt rather than name.txt. If that matters, use -- instead.
Q
Is this a real attack or a theoretical one?
A
Real. Any directory writable by another user or by uploaded content can be seeded with dash-prefixed filenames specifically to alter the behaviour of cleanup scripts.