diff options
author | Herbert Xu <herbert@gondor.apana.org.au> | 2012-02-25 15:35:18 +0800 |
---|---|---|
committer | maximilian attems <max@stro.at> | 2012-07-02 10:47:34 +0200 |
commit | 61d300672e0c1877482deed0f745b52ef306c7d3 (patch) | |
tree | ad4680c123ec1e485006418e8d4cc8eacbebbc32 | |
parent | 4a84d61a24296b8253b3f8f7c86ee28df53e2f3b (diff) | |
download | klibc-61d300672e0c1877482deed0f745b52ef306c7d3.tar.gz |
[klibc] [VAR] Sanitise environment variable names on entry
On Tue, Feb 14, 2012 at 10:48:48AM +0000, harald@redhat.com wrote:
>
> "export -p" prints all environment variables, without checking if the
> environment variable is a valid dash variable name.
>
> IMHO, the only valid usecase for "export -p" is to eval the output.
>
> $ eval $(export -p); echo OK
> OK
>
> Without this patch the following test does error out with:
>
> test.py:
> import os
> os.environ["test-test"]="test"
> os.environ["test_test"]="test"
> os.execv("./dash", [ './dash', '-c', 'eval $(export -p); echo OK' ])
>
> $ python test.py
> ./dash: 1: export: test-test: bad variable name
>
> Of course the results can be more evil, if the environment variable
> name is crafted, that it injects valid shell code.
This patch fixes the issue by sanitising all environment variable names
upon entry into the shell.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: maximilian attems <max@stro.at>
-rw-r--r-- | usr/dash/var.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/usr/dash/var.c b/usr/dash/var.c index 027beff154861..dc90249f2ad8f 100644 --- a/usr/dash/var.c +++ b/usr/dash/var.c @@ -136,7 +136,8 @@ INIT { initvar(); for (envp = environ ; *envp ; envp++) { - if (strchr(*envp, '=')) { + p = endofname(*envp); + if (p != *envp && *p == '=') { setvareq(*envp, VEXPORT|VTEXTFIXED); } } |