Your message dated Tue, 20 Sep 2011 17:33:42 +0200
with message-id <[email protected]>
and subject line Re: Bug#406205: libfile-find-rule-perl: Taint mode fails
has caused the Debian Bug report #406205,
regarding libfile-find-rule-perl: Taint mode fails
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
406205: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=406205
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: libfile-find-rule-perl
Version: 0.30-2
Severity: important
Tags: patch
On etch, the taint mode won't work:
$ perl -MFile::Find::Rule -Tle '$rule=File::Find::Rule->new->extras({ untaint
=> 1 })->start($ARGV[0]); while ($f = $rule->match ) { print $f; }' .
Insecure dependency in chdir while running with -T switch at
/usr/share/perl5/File/Find/Rule.pm line 591.
This _will_ render alls scripts, program and applications
using taint mode and this module unusable.
The bug is listed at CPAN for about 2 months now:
http://rt.cpan.org/Public/Bug/Display.html?id=20418
However, the untainting in that patch is just a slob job.
Mine does real untainting.
Patch (taken from working version 0.28 from sarge):
--- Rule.pm.030 2007-01-09 16:10:53.000000000 +0100
+++ Rule.pm.030.fixed 2007-01-09 16:10:53.000000000 +0100
@@ -575,6 +575,12 @@
my $sub = eval "$code" or die "compile error '$code' $@";
my $cwd = getcwd;
+ # Untaint it
+ if ( $cwd =~ qr|^([-+@\w./]+)$| ) {
+ $cwd = $1;
+ } else {
+ die "Couldn't untaint \$cwd: [$cwd]";
+ }
for my $path (@_) {
# $topdir is used for relative and maxdepth
$topdir = $path;
-- System Information:
Debian Release: 4.0
APT prefers testing
APT policy: (700, 'testing'), (500, 'unstable')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-3-686
Locale: LANG=en_GB, LC_CTYPE=en_GB (charmap=ISO-8859-15)
Versions of packages libfile-find-rule-perl depends on:
ii libnumber-compare-perl 0.01-4 Perform numeric comparisons in Per
ii libtext-glob-perl 0.07-1 Match globbing patterns against te
ii perl 5.8.8-7 Larry Wall's Practical Extraction
ii perl-modules 5.8.8-7 Core Perl modules
libfile-find-rule-perl recommends no packages.
-- no debconf information
--- End Message ---
--- Begin Message ---
Version: 0.32-1
On Tue, 09 Jan 2007 17:50:47 -0600, Gunnar Wolf wrote:
> PS- I'm following up this report to the upstream bug you mentioned, as
> it belongs to upstream development and not in Debian.
According to the upstream bug report at
https://rt.cpan.org/Public/Bug/Display.html?id=20418
this is fixed since 0.31.
Closing this bug accordingly (with 0.32-1 which seems to be the first
upload afterwards.)
Cheers,
gregor
--
.''`. Homepage: http://info.comodo.priv.at/ - PGP/GPG key ID: 0x8649AA06
: :' : Debian GNU/Linux user, admin, & developer - http://www.debian.org/
`. `' Member of VIBE!AT & SPI, fellow of Free Software Foundation Europe
`- NP: Rigmor Gustafsson: Makin' Whoopee
signature.asc
Description: Digital signature
--- End Message ---
