kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

Fixed command Injection

Browse source 
* lib/resolv.rb (Resolv::Config.parse_resolv_conf): fixed
  potential command injection by use of Kernel#open.
  [ruby-core:84347] [Bug #14205]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61351 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
nobu 2017-12-20 04:25:01 +00:00
parent c08e8886ba
commit cdf1b85ae7
3 changed files with 22 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/resolv.rb
View file

@ -928,7 +928,7 @@ class Resolv
nameserver = []
search = nil
ndots = 1
open(filename, 'rb') {|f|
File.open(filename, 'rb') {|f|
f.each {|line|
line.sub!(/[#;].*/, '')
keyword, *args = line.split(/\s+/)

11
test/resolv/test_addr.rb
View file

@ -27,4 +27,15 @@ class TestResolvAddr < Test::Unit::TestCase
end
end
end
def test_hosts_by_command
Dir.mktmpdir do |dir|
Dir.chdir(dir) do
hosts = Resolv::Hosts.new("|echo error")
assert_raise(Errno::ENOENT) do
hosts.each_name("") {}
end
end
end
end
end

10
test/resolv/test_dns.rb
View file

@ -179,6 +179,16 @@ class TestResolvDNS < Test::Unit::TestCase
end
end
def test_resolv_conf_by_command
Dir.mktmpdir do |dir|
Dir.chdir(dir) do
assert_raise(Errno::ENOENT) do
Resolv::DNS::Config.parse_resolv_conf("|echo foo")
end
end
end
end
def test_dots_diffences
name1 = Resolv::DNS::Name.create("example.org")
name2 = Resolv::DNS::Name.create("ex.ampl.eo.rg")