Attachment 902395 Details for Bug 1101346 – revised hiera-1.3.3 patch

[patch] revised hiera-1.3.3 patch

hiera-1.3.3-remove-current-directory-from-Ruby-load-path.patch (text/plain), 1020 bytes, created by Murray McAllister on 2014-06-05 04:57:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Murray McAllister

Created: 2014-06-05 04:57:34 UTC

Size: 1020 bytes

patch

obsolete

>From 5b71548ca9ea9ced460b2970c3e8fb483b495806 Mon Sep 17 00:00:00 2001
>From: Peter Huene <peter.huene@puppetlabs.com>
>Date: Wed, 7 May 2014 11:07:58 -0700
>Subject: [PATCH] (HI-238) Remove current directory from Ruby load path.
>
>The current directory ('.') is on the load path for Ruby 1.8.7.
>This is a security vulnerability as it allows arbitrary code loading if
>users create ruby source files with names that correspond to those that
>hiera is trying to load.
>
>The fix is to explicitly remove '.' from the load path before any code
>is loaded by hiera.
>---
> bin/hiera | 4 ++++
> 1 file changed, 4 insertions(+)
>
>diff --git a/bin/hiera b/bin/hiera
>index ce2875e..1e6c46b 100755
>--- a/bin/hiera
>+++ b/bin/hiera
>@@ -1,5 +1,9 @@
> #!/usr/bin/env ruby
> 
>+# For security reasons, ensure that '.' is not on the load path
>+# This is primarily for 1.8.7 since 1.9.2+ doesn't put '.' on the load path
>+$LOAD_PATH.delete '.'
>+
> # CLI client for Hiera.
> #
> # To lookup the 'release' key for a node given Puppet YAML facts:
>-- 
>1.9.2
>

Actions: View | Diff

Attachments on bug 1101346: 899370 | 899371 | 899372 | 899373 | 902394 | 902395 | 902396 | 902397 | 902398