[#8976] Insecure warnings on sticky-bit directories — "Laurent Sansonetti" <laurent.sansonetti@...>
Hi,
[#8978] Inheritance and Autorunner: Default_test causes a problem — <noreply@...>
Bugs item #5990, was opened at 2006-10-02 10:05
Hi,
[#8997] Re: [ruby-cvs:18323] ruby: * eval.c (splat_value): use "to_splat" instead of "to_ary" to — Mathieu Bouchard <matju@...>
On Tue, 3 Oct 2006, matz wrote:
Hi,
On Wed, 4 Oct 2006, Yukihiro Matsumoto wrote:
Hi,
Hi --
Yukihiro Matsumoto wrote:
Hi,
Hi --
Hi,
Hi --
Hi,
Hi --
On Oct 9, 2006, at 10:19 AM, dblack@wobblini.net wrote:
On 2006.10.10 00:31, James Edward Gray II wrote:
On Oct 9, 2006, at 11:50 AM, Eero Saynatkari wrote:
Hi --
dblack@wobblini.net wrote:
Thomas Enebo wrote:
Hi --
Hi --
Hi,
Hi --
Hi,
On 10/10/06, Yukihiro Matsumoto <matz@ruby-lang.org> wrote:
Hi,
On Oct 10, 2006, at 8:43 AM, Yukihiro Matsumoto wrote:
From: <dblack@wobblini.net>
Hi --
> to_a was too general. All enumerable objects (and even
Brown, Warren wrote:
> -----Original Message-----
[#8999] making FileUtils.rm_rf robust: is anyone interested? — Jim Meyering <list+ruby@...>
Hello,
Hi,
"Nobuyoshi Nakada" <nobu@ruby-lang.org> wrote:
[#9014] C#'s ?? Operator — "Nikolai Weibull" <now@...>
Hi!
[#9021] argument passing bug — Mathieu Bouchard <matju@...>
[#9024] — Shashank Date <sdate@...>
Hi All,
[#9077] how to create a NODE_ARGSPUSH? — Ryan Davis <ryand-ruby@...>
Is it possible for plain ruby code to create a NODE_ARGSPUSH? It
[#9104] Loop over array.delete breaks at first hit — <noreply@...>
Bugs item #6090, was opened at 2006-10-10 22:33
Hi,
[#9119] What about 'splay'? — dblack@...
Hi --
On 2006.10.12 02:32, dblack@wobblini.net wrote:
On Wednesday 11 October 2006 13:55, Eero Saynatkari wrote:
Hi --
dblack@wobblini.net wrote:
Hi --
On 2006.10.12 03:36, Sean Russell wrote:
On 10/11/06, dblack@wobblini.net <dblack@wobblini.net> wrote:
[#9152] regular expressions tainting? — hadmut@... (Hadmut Danisch)
Hi,
Hi,
On Thu, Oct 12, 2006 at 01:01:36PM +0900, Nobuyoshi Nakada wrote:
It's worse:
Hi,
On Oct 15, 2006, at 1:20 AM, Hadmut Danisch wrote:
On Sun, Oct 15, 2006 at 05:33:16PM +0900, Eric Hodel wrote:
[#9158] Module#class_variable_defined? — Mauricio Fernandez <mfp@...>
[#9188] Symbol < String in Ruby > 1.8 — dblack@...
Hi --
Hi
Yukihiro Matsumoto wrote:
Charles Oliver Nutter wrote:
Charles Oliver Nutter wrote:
Jim Weirich wrote:
On Thu, Oct 19, 2006 at 05:06:02AM +0900, Charles Oliver Nutter wrote:
Hi,
Quoting matz@ruby-lang.org, on Thu, Oct 19, 2006 at 01:40:42PM +0900:
Hi,
Quoting matz@ruby-lang.org, on Thu, Oct 19, 2006 at 02:49:30PM +0900:
Hi,
Quoting matz@ruby-lang.org, on Thu, Oct 19, 2006 at 11:22:18PM +0900:
On 10/15/06, dblack@wobblini.net <dblack@wobblini.net> wrote:
Hi --
On 10/15/06, dblack@wobblini.net <dblack@wobblini.net> wrote:
Hi,
On 10/16/06, Yukihiro Matsumoto <matz@ruby-lang.org> wrote:
On Oct 16, 2006, at 3:06 PM, Rick DeNatale wrote:
On Tue, Oct 17, 2006 at 05:14:09AM +0900, James Edward Gray II wrote:
On 10/16/06, Sam Roberts <sroberts@uniserve.com> wrote:
Hi,
Hi --
On Oct 17, 2006, at 7:29 PM, dblack@wobblini.net wrote:
Hi --
On Oct 18, 2006, at 4:18 AM, dblack@wobblini.net wrote:
On 10/18/06, Eric Hodel <drbrain@segment7.net> wrote:
On 10/18/06, Nikolai Weibull <now@bitwi.se> wrote:
On 10/18/06, mathew <meta@pobox.com> wrote:
On Thu, Oct 19, 2006 at 04:24:24AM +0900, Nikolai Weibull wrote:
On 10/18/06, Mauricio Fernandez <mfp@acm.org> wrote:
Hi --
On 10/18/06, dblack@wobblini.net <dblack@wobblini.net> wrote:
Hi -
Hi,
Hi --
Rick DeNatale wrote:
Hi --
Hi,
Hi --
On 10/19/06, dblack@wobblini.net <dblack@wobblini.net> wrote:
Hi --
On 10/19/06, dblack@wobblini.net <dblack@wobblini.net> wrote:
Hi --
dblack@wobblini.net wrote:
Hi --
Hi,
Hi --
Hi,
Hi --
On 10/20/06, dblack@wobblini.net <dblack@wobblini.net> wrote:
Hi --
Hi,
On Sat, Oct 21, 2006 at 01:11:36AM +0900, dblack@wobblini.net wrote:
Hi,
On Oct 18, 2006, at 11:37 AM, Nikolai Weibull wrote:
[#9197] Ruby Threads — "Abhisek Datta" <abhisek@...>
Hello,
[#9282] Re: String not enumerable, what about IO? — "Michael Selig" <michael.selig@...>
I am fairly new to ruby, and I have just started listening to this mailing
[#9341] array.c - defining aliases as aliases — "Daniel Berger" <djberg96@...>
Hi all,
On Oct 27, 2006, at 11:12 AM, Daniel Berger wrote:
[#9351] Module#method_aliased and Module#singleton_method_aliased — "Daniel Berger" <djberg96@...>
Hi all,
Insecure warnings on sticky-bit directories
Hi,
Currently, Ruby prints a warning when a directory that is part of
$PATH is world-writable, even if it has the sticky-bit set.
$ stat -Lx /tmp
File: "/tmp"
Size: 340 FileType: Directory
Mode: (0777/drwxrwxrwt) Uid: ( 0/ root) Gid: ( 0/ wheel)
Device: 14,5 Inode: 24 Links: 5
Access: Mon Oct 2 14:14:43 2006
Modify: Mon Oct 2 15:10:13 2006
Change: Mon Oct 2 15:10:13 2006
$ PATH=$PATH:/tmp ruby -e "system('id')"
-e:1: warning: Insecure world writable dir /tmp, mode 041777
uid=501(lrz) gid=501(lrz) groups=501(lrz), 81(_appserveradm),
79(_appserverusr), 80(admin)
This is due to the fact that file.c:rb_path_check() always call
path_check_0() with the loadpath argument to Qtrue. A fix would be to
make sure the loadpath argument is only set when checking the load
path, and not otherwise.
Here is a quick tiny patch against 1.8.5 source tree, feel free to
check it out. It seems to solve the problem.
Laurent
Attachments (1)
--- file.c.old 2006-10-02 15:15:46.000000000 +0200
+++ file.c 2006-10-02 15:16:29.000000000 +0200
@@ -4151,9 +4151,10 @@
#endif
}
-int
-rb_path_check(path)
+static int
+__rb_path_check(path, loadpath)
char *path;
+ int loadpath;
{
#ifndef DOSISH
char *p0, *p, *pend;
@@ -4167,7 +4168,7 @@
if (!p) p = pend;
for (;;) {
- if (!path_check_0(rb_str_new(p0, p - p0), Qtrue)) {
+ if (!path_check_0(rb_str_new(p0, p - p0), loadpath)) {
return 0; /* not safe */
}
p0 = p + 1;
@@ -4179,6 +4180,20 @@
return 1;
}
+int
+rb_path_check(path)
+ char *path;
+{
+ return __rb_path_check(path, Qfalse);
+}
+
+int
+rb_loadpath_check(path)
+ char *path;
+{
+ return __rb_path_check(path, Qtrue);
+}
+
#if defined(__MACOS__) || defined(riscos)
static int
is_macos_native_path(path)
@@ -4315,7 +4330,7 @@
}
else {
lpath = RSTRING(tmp)->ptr;
- if (rb_safe_level() >= 1 && !rb_path_check(lpath)) {
+ if (rb_safe_level() >= 1 && !rb_loadpath_check(lpath)) {
rb_raise(rb_eSecurityError, "loading from unsafe path %s", lpath);
}
}