From 401ff253ef38889be85d9cc3f06ef98d7c2a35a2 Mon Sep 17 00:00:00 2001 From: nobu Date: Mon, 4 Sep 2006 20:50:13 +0000 Subject: * file.c (path_check_0): check if sticky bit is set on parent directories for executable path. fixed: [ruby-dev:29415] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8@10863 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- file.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) (limited to 'file.c') diff --git a/file.c b/file.c index ac7b548dbf..a2726d1df1 100644 --- a/file.c +++ b/file.c @@ -4099,9 +4099,9 @@ is_absolute_path(path) #ifndef DOSISH static int -path_check_0(fpath, loadpath) +path_check_0(fpath, execpath) VALUE fpath; - int loadpath; + int execpath; { struct stat st; char *p0 = StringValueCStr(fpath); @@ -4116,7 +4116,7 @@ path_check_0(fpath, loadpath) rb_str_cat2(newpath, "/"); rb_str_cat2(newpath, p0); - return path_check_0(newpath, loadpath); + p0 = RSTRING(fpath = newpath)->ptr; } for (;;) { #ifndef S_IWOTH @@ -4124,10 +4124,11 @@ path_check_0(fpath, loadpath) #endif if (stat(p0, &st) == 0 && S_ISDIR(st.st_mode) && (st.st_mode & S_IWOTH) #ifdef S_ISVTX - && (loadpath || !(st.st_mode & S_ISVTX)) + && !(p && execpath && (st.st_mode & S_ISVTX)) #endif ) { - rb_warn("Insecure world writable dir %s, mode 0%o", p0, st.st_mode); + rb_warn("Insecure world writable dir %s in %sPATH, mode 0%o", + p0, (execpath ? "" : "LOAD_"), st.st_mode); if (p) *p = '/'; return 0; } @@ -4315,9 +4316,6 @@ rb_find_file(path) } else { lpath = RSTRING(tmp)->ptr; - if (rb_safe_level() >= 1 && !rb_path_check(lpath)) { - rb_raise(rb_eSecurityError, "loading from unsafe path %s", lpath); - } } } else { -- cgit v1.2.3