Mailing List Archive: SpamAssassin: devel

[Bug 6148] sa-update fails: Insecure dependency in mkdir

Index | Next | Previous | View Threaded

bugzilla-daemon at bugzilla

Jul 7, 2009, 6:01 AM

Post #1 of 5 (451 views)
Permalink

[Bug 6148] sa-update fails: Insecure dependency in mkdir

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6148

--- Comment #1 from Mark Martinec <Mark.Martinec [at] ijs> 2009-07-07 06:01:30 PST ---
(my yesterdays posting, just for documentation):

I've seen it last week, looks like an old Perl bug of a tainted $1
is rearing its head again. The following patch to File/Basename.pm
avoids the trouble:

--- Basename.pm~ 2009-06-09 16:31:34.000000000 +0200
+++ Basename.pm 2009-06-27 15:49:49.000000000 +0200
@@ -332,4 +332,5 @@
my $type = $Fileparse_fstype;

+ local $1;
if ($type eq 'MacOS') {
$_[0] =~ s/([^:]):\z/$1/s;

Here the $_[0] is NOT tainted, but $1 is, so the $_[0] gets tainted,
which leads to a failure in mkdir further on.

--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

bugzilla-daemon at bugzilla

Jul 7, 2009, 6:02 AM

Post #2 of 5 (409 views)
Permalink

[Bug 6148] sa-update fails: Insecure dependency in mkdir [In reply to]

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6148

--- Comment #2 from Mark Martinec <Mark.Martinec [at] ijs> 2009-07-07 06:02:58 PST ---
Bug 6148: avoid $1 from getting tainted by fiddling with
sub get_description_for_rule, and by localizing $1 throughout
the sa-update. Use explicit untaining by untaint_var there
instead of manually untainting variables.
Sending lib/Mail/SpamAssassin/Conf.pm
Sending lib/Mail/SpamAssassin/PerMsgStatus.pm
Sending sa-update.raw
Committed revision 791820 ( https://svn.apache.org/viewcvs.cgi?view=rev&rev=791820 ).

--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

bugzilla-daemon at bugzilla

Jul 7, 2009, 6:04 AM

Post #3 of 5 (413 views)
Permalink

[Bug 6148] sa-update fails: Insecure dependency in mkdir [In reply to]

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6148

--- Comment #3 from Justin Mason <jm [at] jmason> 2009-07-07 06:04:18 PST ---
painful, but +1.

--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

bugzilla-daemon at bugzilla

Jul 7, 2009, 6:12 AM

Post #4 of 5 (415 views)
Permalink

[Bug 6148] sa-update fails: Insecure dependency in mkdir [In reply to]

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6148

--- Comment #4 from Mark Martinec <Mark.Martinec [at] ijs> 2009-07-07 06:12:04 PST ---
(In reply to comment #0)
> sa-update of spamassassin-3.3.0-alpha1 fails with the *.pre files from trunk.
> If I delete and instead copy the *.pre files from 3.2.5, then sa-update
> succeeds.

Btw, the difference there in the .pre files is that AWL plugin is
now commented out in v310.pre. Interestingly, uncommenting it
(enabling it again) mysteriously avoids the taint bug.

I'll attach the diff to make it easier for Warren to test it.

--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

bugzilla-daemon at bugzilla

Jul 7, 2009, 6:14 AM

Post #5 of 5 (415 views)
Permalink

[Bug 6148] sa-update fails: Insecure dependency in mkdir [In reply to]

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6148

--- Comment #5 from Mark Martinec <Mark.Martinec [at] ijs> 2009-07-07 06:14:08 PST ---
Created an attachment (id=4477)
--> (https://issues.apache.org/SpamAssassin/attachment.cgi?id=4477)
A workaround for $1 getting tainted and spreading taint

--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads