kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

* file.c (path_check_0): check if sticky bit is set on parent

Browse source 
directories for executable path.  fixed: [ruby-dev:29415]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@10863 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
nobu 2006-09-04 20:50:13 +00:00
parent 5f61a22950
commit b9a508bb96
2 changed files with 10 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ChangeLog
View file

@ -1,3 +1,8 @@
Tue Sep 5 05:49:41 2006 Nobuyoshi Nakada <nobu@ruby-lang.org>
* file.c (path_check_0): check if sticky bit is set on parent
directories for executable path. fixed: [ruby-dev:29415]
Tue Sep 5 05:03:46 2006 Yukihiro Matsumoto <matz@ruby-lang.org> Tue Sep 5 05:03:46 2006 Yukihiro Matsumoto <matz@ruby-lang.org>
* numeric.c (fix_plus): addition in Fixnum will never overflow * numeric.c (fix_plus): addition in Fixnum will never overflow

12
file.c
View file

@ -4046,7 +4046,7 @@ is_absolute_path(const char *path)
#ifndef DOSISH #ifndef DOSISH
static int static int
path_check_0(VALUE path, int loadpath) path_check_0(VALUE path, int execpath)
{ {
struct stat st; struct stat st;
char *p0 = StringValueCStr(path); char *p0 = StringValueCStr(path);
@ -4061,7 +4061,7 @@ path_check_0(VALUE path, int loadpath)
rb_str_cat2(newpath, "/"); rb_str_cat2(newpath, "/");
rb_str_cat2(newpath, p0); rb_str_cat2(newpath, p0);
return path_check_0(newpath, loadpath); p0 = RSTRING_PTR(path = newpath);
} }
for (;;) { for (;;) {
#ifndef S_IWOTH #ifndef S_IWOTH
@ -4069,10 +4069,11 @@ path_check_0(VALUE path, int loadpath)
#endif #endif
if (stat(p0, &st) == 0 && S_ISDIR(st.st_mode) && (st.st_mode & S_IWOTH) if (stat(p0, &st) == 0 && S_ISDIR(st.st_mode) && (st.st_mode & S_IWOTH)
#ifdef S_ISVTX #ifdef S_ISVTX
&& (loadpath || !(st.st_mode & S_ISVTX)) && !(p && execpath && (st.st_mode & S_ISVTX))
#endif #endif
&& !access(p0, W_OK)) { && !access(p0, W_OK)) {
rb_warn("Insecure world writable dir %s, mode 0%o", p0, st.st_mode); rb_warn("Insecure world writable dir %s in %sPATH, mode 0%o",
p0, (execpath ? "" : "LOAD_"), st.st_mode);
if (p) *p = '/'; if (p) *p = '/';
return 0; return 0;
} }
@ -4247,9 +4248,6 @@ rb_find_file(VALUE path)
} }
else { else {
lpath = RSTRING_PTR(tmp); lpath = RSTRING_PTR(tmp);
if (rb_safe_level() >= 1 && !rb_path_check(lpath)) {
rb_raise(rb_eSecurityError, "loading from unsafe path %s", lpath);
}
} }
} }
else { else {