Attachment 902397 Details for Bug 1101346 – revised puppet-2.7.25 patch

[patch] revised puppet-2.7.25 patch

puppet-2.7.25-remove-current-directory-from-Ruby-load-path.patch (text/plain), 2.66 KB, created by Murray McAllister on 2014-06-05 04:59:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Murray McAllister

Created: 2014-06-05 04:59:22 UTC

Size: 2.66 KB

patch

obsolete

>From b7ed36426f3342e347e74910b5a3418c09f2b336 Mon Sep 17 00:00:00 2001
>From: Peter Huene <peter.huene@puppetlabs.com>
>Date: Tue, 6 May 2014 14:06:55 -0700
>Subject: [PATCH] (PUP-2478) Remove current directory from Ruby load path.
>
>The current directory ('.') is on the load path for Ruby 1.8.7.
>This is a security vulnerability as it allows arbitrary code loading if
>users create ruby source files with names that correspond to those that
>puppet is trying to load.
>
>The fix is to explicitly remove '.' from the load path before any code
>is loaded by puppet.
>
>(PUP-2683) Fix fact terminus to load facts without '.' on the load path.
>
>The fix to PUP-2478 removed '.' from the load path, which only affected
>Ruby 1.8.7.  However, the fact terminus does "load <filename>" to load
>module facts.  In Ruby 1.8.7, this will fail to load because '.' is no
>longer on the load path.  In Ruby 1.9.3+, loading with just a filename
>assumes the current directory even without '.' on the load path.
>
>This commit fixes the issue by joining '.' with the filename which
>works in all currently supported Ruby versions.
>
>diff --git a/bin/puppet b/bin/puppet
>index c030702..c80174f 100755
>--- a/bin/puppet
>+++ b/bin/puppet
>@@ -1,4 +1,8 @@
> #!/usr/bin/env ruby
> 
>+# For security reasons, ensure that '.' is not on the load path
>+# This is primarily for 1.8.7 since 1.9.2+ doesn't put '.' on the load path
>+$LOAD_PATH.delete '.'
>+
> require 'puppet/util/command_line'
> Puppet::Util::CommandLine.new.execute
>diff --git a/lib/puppet/indirector/facts/facter.rb b/lib/puppet/indirector/facts/facter.rb
>index e41ef02..18f13ee 100644
>--- a/lib/puppet/indirector/facts/facter.rb
>+++ b/lib/puppet/indirector/facts/facter.rb
>@@ -45,7 +45,7 @@ class Puppet::Node::Facts::Facter < Puppet::Indirector::Code
>         begin
>           Puppet.info "Loading facts in #{fqfile}"
>           Timeout::timeout(self.timeout) do
>-            load file
>+            load File.join('.', file)
>           end
>         rescue SystemExit,NoMemoryError
>           raise
>diff --git a/spec/unit/indirector/facts/facter_spec.rb b/spec/unit/indirector/facts/facter_spec.rb
>index 0cb8037..a9f3dcc 100755
>--- a/spec/unit/indirector/facts/facter_spec.rb
>+++ b/spec/unit/indirector/facts/facter_spec.rb
>@@ -123,8 +123,8 @@ describe Puppet::Node::Facts::Facter do
> 
>     Dir.expects(:glob).with("*.rb").returns %w{a.rb b.rb}
> 
>-    Puppet::Node::Facts::Facter.expects(:load).with("a.rb")
>-    Puppet::Node::Facts::Facter.expects(:load).with("b.rb")
>+    Puppet::Node::Facts::Facter.expects(:load).with File.join('.', 'a.rb')
>+    Puppet::Node::Facts::Facter.expects(:load).with File.join('.', 'b.rb')
> 
>     Puppet::Node::Facts::Facter.load_facts_in_dir("mydir")
>   end
>-- 
>1.8.4.3
>

Actions: View | Diff

Attachments on bug 1101346: 899370 | 899371 | 899372 | 899373 | 902394 | 902395 | 902396 | 902397 | 902398