lang/perl/patches/900-CVE-2015-8607.patch

   1 From b6307f728a4f842a54ea96959e386c7daa92ece1 Mon Sep 17 00:00:00 2001
   2 From: Tony Cook <tony@develop-help.com>
   3 Date: Tue, 15 Dec 2015 10:56:54 +1100
   4 Subject: [perl #126862] ensure File::Spec::canonpath() preserves taint
   5
   6 Previously the unix specific XS implementation of canonpath() would
   7 return an untainted path when supplied a tainted path.
   8
   9 For the empty string case, newSVpvs() already sets taint as needed on
  10 its result.
  11 ---
  12  dist/PathTools/Cwd.xs    |  1 +
  13  dist/PathTools/t/taint.t | 19 ++++++++++++++++++-
  14  2 files changed, 19 insertions(+), 1 deletion(-)
  15
  16 --- a/dist/PathTools/Cwd.xs
  17 +++ b/dist/PathTools/Cwd.xs
  18 @@ -535,6 +535,7 @@ THX_unix_canonpath(pTHX_ SV *path)
  19      *o = 0;
  20      SvPOK_on(retval);
  21      SvCUR_set(retval, o - SvPVX(retval));
  22 +    SvTAINT(retval);
  23      return retval;
  24  }
  25
  26 --- a/dist/PathTools/t/taint.t
  27 +++ b/dist/PathTools/t/taint.t
  28 @@ -12,7 +12,7 @@ use Test::More;
  29  BEGIN {
  30      plan(
  31          ${^TAINT}
  32 -        ? (tests => 17)
  33 +        ? (tests => 21)
  34          : (skip_all => "A perl without taint support")
  35      );
  36  }
  37 @@ -34,3 +34,20 @@ foreach my $func (@Functions) {
  38
  39  # Previous versions of Cwd tainted $^O
  40  is !tainted($^O), 1, "\$^O should not be tainted";
  41 +
  42 +{
  43 +    # [perl #126862] canonpath() loses taint
  44 +    my $tainted = substr($ENV{PATH}, 0, 0);
  45 +    # yes, getcwd()'s result should be tainted, and is tested above
  46 +    # but be sure
  47 +    ok tainted(File::Spec->canonpath($tainted . Cwd::getcwd)),
  48 +        "canonpath() keeps taint on non-empty string";
  49 +    ok tainted(File::Spec->canonpath($tainted)),
  50 +        "canonpath() keeps taint on empty string";
  51 +
  52 +    (Cwd::getcwd() =~ /^(.*)/);
  53 +    my $untainted = $1;
  54 +    ok !tainted($untainted), "make sure our untainted value is untainted";
  55 +    ok !tainted(File::Spec->canonpath($untainted)),
  56 +        "canonpath() doesn't add taint to untainted string";
  57 +}