[#65451] [ruby-trunk - Feature #10333] [PATCH 3/1] optimize: "yoda literal" == string — ko1@...

Issue #10333 has been updated by Koichi Sasada.

9 messages 2014/10/07

[ruby-core:65569] Re: [ruby-trunk - Feature #10351] [Open] [PATCH] prevent CVE-2014-6277

From: Eric Wong <normalperson@...>
Date: 2014-10-09 17:16:48 UTC
List: ruby-core #65569
shyouhei@ruby-lang.org wrote:
> This patch does not add a new feature, nor delete anything.  It just
> changes the default behaviour when ruby spawns subprocesses.
> 
>     Process.spawn('/usr/bin/printenv') # -> prints nothing

The potential for breakage is way too high.  Losing some envs (e.g.
PATH, TMPDIR, SHELL or HOME) can be disastrous and introduce new
security problems.

Right now, everybody knows about shellshock and patching bash.
This is an over-reaction which causes needless breakage.

(Especially since your example never even spawns a shell)

In This Thread