900-CVE-2015-8607.patch (1860B)
1 From b6307f728a4f842a54ea96959e386c7daa92ece1 Mon Sep 17 00:00:00 2001 2 From: Tony Cook <tony@develop-help.com> 3 Date: Tue, 15 Dec 2015 10:56:54 +1100 4 Subject: [perl #126862] ensure File::Spec::canonpath() preserves taint 5 6 Previously the unix specific XS implementation of canonpath() would 7 return an untainted path when supplied a tainted path. 8 9 For the empty string case, newSVpvs() already sets taint as needed on 10 its result. 11 --- 12 dist/PathTools/Cwd.xs | 1 + 13 dist/PathTools/t/taint.t | 19 ++++++++++++++++++- 14 2 files changed, 19 insertions(+), 1 deletion(-) 15 16 --- a/dist/PathTools/Cwd.xs 17 +++ b/dist/PathTools/Cwd.xs 18 @@ -535,6 +535,7 @@ THX_unix_canonpath(pTHX_ SV *path) 19 *o = 0; 20 SvPOK_on(retval); 21 SvCUR_set(retval, o - SvPVX(retval)); 22 + SvTAINT(retval); 23 return retval; 24 } 25 26 --- a/dist/PathTools/t/taint.t 27 +++ b/dist/PathTools/t/taint.t 28 @@ -12,7 +12,7 @@ use Test::More; 29 BEGIN { 30 plan( 31 ${^TAINT} 32 - ? (tests => 17) 33 + ? (tests => 21) 34 : (skip_all => "A perl without taint support") 35 ); 36 } 37 @@ -34,3 +34,20 @@ foreach my $func (@Functions) { 38 39 # Previous versions of Cwd tainted $^O 40 is !tainted($^O), 1, "\$^O should not be tainted"; 41 + 42 +{ 43 + # [perl #126862] canonpath() loses taint 44 + my $tainted = substr($ENV{PATH}, 0, 0); 45 + # yes, getcwd()'s result should be tainted, and is tested above 46 + # but be sure 47 + ok tainted(File::Spec->canonpath($tainted . Cwd::getcwd)), 48 + "canonpath() keeps taint on non-empty string"; 49 + ok tainted(File::Spec->canonpath($tainted)), 50 + "canonpath() keeps taint on empty string"; 51 + 52 + (Cwd::getcwd() =~ /^(.*)/); 53 + my $untainted = $1; 54 + ok !tainted($untainted), "make sure our untainted value is untainted"; 55 + ok !tainted(File::Spec->canonpath($untainted)), 56 + "canonpath() doesn't add taint to untainted string"; 57 +}