bundle relative paths using ".."

Larry O'Leary loleary at redhat.com
Fri Apr 26 14:08:43 UTC 2013


On Fri, 2013-04-26 at 09:11 +0200, Heiko W.Rupp wrote:
> Hey,
> 
> Am 26.04.2013 um 07:28 schrieb John Mazzitelli:
> 
> > Ignore my ramblings. I think I have it fixed and it allows users to use ".." in relative or absolute paths. If they use ".." and it takes the file out of the dest dir, I simply convert it as if it were an external, absolute path specified (I'll convert to a absolute, canonical path). If it stays within dest dir, I just make the relative path canonical (though remaining relative to dest dir). I have unit tests showing this working so I'm feeling OK to commit this. This is BZ https://bugzilla.redhat.com/show_bug.cgi?id=917085 in case you care.
> 
> 
> Try creating a bundle that has a file named password in it and craft a relative path that ends up deploying the bundle in /etc - as some users run the agent as
> root, this may end up in a lot of fun ...
> 
Better yet, set your destination to '/' and if you are running as root,
watch as much of your file system becomes a whole lot flatter with very
little to look at.
-- 
Larry O'Leary
https://plus.google.com/u/0/112645929986009801513



More information about the rhq-devel mailing list