bundle relative paths using ".."

Heiko W.Rupp hrupp at redhat.com
Fri Apr 26 07:11:12 UTC 2013


Hey,

Am 26.04.2013 um 07:28 schrieb John Mazzitelli:

> Ignore my ramblings. I think I have it fixed and it allows users to use ".." in relative or absolute paths. If they use ".." and it takes the file out of the dest dir, I simply convert it as if it were an external, absolute path specified (I'll convert to a absolute, canonical path). If it stays within dest dir, I just make the relative path canonical (though remaining relative to dest dir). I have unit tests showing this working so I'm feeling OK to commit this. This is BZ https://bugzilla.redhat.com/show_bug.cgi?id=917085 in case you care.


Try creating a bundle that has a file named password in it and craft a relative path that ends up deploying the bundle in /etc - as some users run the agent as
root, this may end up in a lot of fun ...

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 203 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <https://lists.fedorahosted.org/pipermail/rhq-devel/attachments/20130426/a0afc50b/attachment.sig>


More information about the rhq-devel mailing list