[#63592] [ruby-trunk - Bug #10009] IO operation is 10x slower in multi-thread environment — normalperson@...
Issue #10009 has been updated by Eric Wong.
3 messages
2014/07/08
[#63682] [ruby-trunk - Feature #10030] [PATCH] reduce rb_iseq_struct to 296 bytes — ko1@...
Issue #10030 has been updated by Koichi Sasada.
3 messages
2014/07/13
[#63703] [ruby-trunk - Feature #10030] [PATCH] reduce rb_iseq_struct to 296 bytes — ko1@...
Issue #10030 has been updated by Koichi Sasada.
3 messages
2014/07/14
[#63743] [ruby-trunk - Bug #10037] Since r46798 on Solaris, "[BUG] rb_vm_get_cref: unreachable" during make — ngotogenome@...
Issue #10037 has been updated by Naohisa Goto.
3 messages
2014/07/15
[#64136] Ruby 2.1.2 (and 2.1.1 and probably others) assumes a libffi with 3 version numbers in extconf.rb — "Jeffrey 'jf' Lim" <jfs.world@...>
As per subject.
4 messages
2014/07/31
[#64138] Re: Ruby 2.1.2 (and 2.1.1 and probably others) assumes a libffi with 3 version numbers in extconf.rb
— "Jeffrey 'jf' Lim" <jfs.world@...>
2014/07/31
On Thu, Jul 31, 2014 at 6:03 PM, Jeffrey 'jf' Lim <[email protected]>
[ruby-core:63839] [ruby-trunk - Bug #10066] [Open] File.expand_path performs poor validation of absolute path
From:
peter@...
Date:
2014-07-18 22:02:29 UTC
List:
ruby-core #63839
Issue #10066 has been reported by Peter Blay. ---------------------------------------- Bug #10066: File.expand_path performs poor validation of absolute path https://bugs.ruby-lang.org/issues/10066 * Author: Peter Blay * Status: Open * Priority: Normal * Assignee: * Category: * Target version: * ruby -v: ruby 2.2.0dev (2014-07-19 trunk 46871) [x86_64-linux] * Backport: 2.0.0: UNKNOWN, 2.1: UNKNOWN ---------------------------------------- With File.expand_path(), if one of the arguments is of the form "~/.*", then it will search for the environment variable $HOME. If this is set to: export HOME="/home/peter" Then searching for File.expand_path '~/.bashrc' works as expected. If the variable is specified as: export HOME="ls -la / #" Then File.expand_path '~/.bashrc' works as expected and raises an ArgumentError for a non-absolute home. However this performs a poor validation on the environment variable, as this works around the issue: export HOME="/bin/bash -c \"ls -la /\" #/home/peter" From here File.expand_path '~/.bashrc' returns: "/bin/bash -c \"ls -la /\" #/home/peter/.bashrc" This potentially enables various security vulnerabilities such as command injection above, if this is passed to a function that runs commands, or could potentially allow an attacker other means of attack on privilege escalation, or to change other values within an application. Please note that this affects both arguments for File.expand_path() -- https://bugs.ruby-lang.org/