Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

grep: avoid shell code evaluation #749

Merged
merged 2 commits into from
Oct 5, 2024
Merged

grep: avoid shell code evaluation #749

merged 2 commits into from
Oct 5, 2024

Conversation

mknos
Copy link
Contributor

@mknos mknos commented Sep 30, 2024

  • When running grep -g or -u, the default code uses Term::Cap but this fails over to executing external tput command
  • tput would be available on Linux/BSD but is not a consideration for Windows
  • Feed the TERM environment variable to tput command in single quotes to prevent shell commands from being initiated though TERM
  • To verify this I had to temporarily bypass the Term::Cap code on my Linux system
  • No other instances of backticks, system() or exec() calls within grep
%TERM='linux;halt -p;' perl  grep -g include a.c   # with patch applied tput fails but system doesn't halt
tput: unknown terminal "linux;halt -p;"
tput: unknown terminal "linux;halt -p;"
#include <stdio.h>
#include <stdlib.h>

@mknos
grep: avoid shell code evaluation
c54e8e1 
* When running grep -g or -u, the default code uses Term::Cap but this fails over to executing external tput command
* tput would be available on Linux/BSD but is not a consideration for Windows
* Feed the TERM environment variable to tput command in single quotes to prevent shell commands from being initiated though TERM
* To verify this I had to temporarily bypass the Term::Cap code on my Linux system
* No other instances of backticks, system() or exec() calls within grep

%TERM='linux;halt -p;' perl  grep -g include a.c   # with patch applied tput fails but system doesn't halt
tput: unknown terminal "linux;halt -p;"
tput: unknown terminal "linux;halt -p;"
#include <stdio.h>
#include <stdlib.h>
@github-actions github-actions bot added Type: enhancement improve a feature that already exists Priority: low get to this whenever Program: grep The grep program labels Sep 30, 2024
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:07 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:07 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:07 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:07 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:07 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:07 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:07 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:07 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:07 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:07 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:07 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:07 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:07 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:07 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:07 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:07 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:07 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:07 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:07 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing September 30, 2024 09:08 — with GitHub Actions Inactive
@coveralls
Copy link

coveralls commented Sep 30, 2024 •
edited
Loading

Pull Request Test Coverage Report for Build 11125842795

Details

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage decreased (-0.7%) to 73.069%
Totals Coverage Status
Change from base Build 11098690193: -0.7%
Covered Lines: 350
Relevant Lines: 479
💛 - Coveralls

briandfoy
briandfoy requested changes Sep 30, 2024
View reviewed changes
@briandfoy briandfoy added the Status: changes requested adjust the pull request as noted in comments label Sep 30, 2024
@mknos
execute tput without subshell
5835d34 
* Previous commit was half baked because invalid user input could still creep into shell
* Switch backticks over to system LIST, which does not execute tput via a shell
* Code for redirecting and restoring STDOUT was lifted out of bin/awk
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
@mknos mknos temporarily deployed to automated_testing October 1, 2024 13:00 — with GitHub Actions Inactive
briandfoy
briandfoy approved these changes Oct 5, 2024
View reviewed changes
@briandfoy briandfoy merged commit 0f7ff6d into briandfoy:master Oct 5, 2024
21 of 22 checks passed
@briandfoy briandfoy self-assigned this Oct 5, 2024
@briandfoy briandfoy added Status: accepted The fix is accepted Type: bug an existing feature does not work and removed Priority: low get to this whenever Type: enhancement improve a feature that already exists Status: changes requested adjust the pull request as noted in comments labels Oct 5, 2024
@briandfoy
Copy link
Owner

changes: be more careful with handling the TERM env var

@briandfoy briandfoy added Status: released there is a new release with this fix and removed Status: accepted The fix is accepted labels Dec 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@briandfoy briandfoy briandfoy approved these changes

Assignees

@briandfoy briandfoy

Labels
Program: grep The grep program Status: released there is a new release with this fix Type: bug an existing feature does not work
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@mknos @coveralls @briandfoy