Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Account for PATH in ProcessStarter::Exec #588

Open
Anton3 opened this issue May 14, 2024 · 0 comments
Open

Account for PATH in ProcessStarter::Exec #588

Anton3 opened this issue May 14, 2024 · 0 comments
Labels
good first issue Good small issue for newcomers help wanted We would appreciate PR

Comments

@Anton3
Copy link
Member

Anton3 commented May 14, 2024

As of now, Exec requires the absolute path to the executable and ignores PATH. This is inconvenient when calling system executables.

This behavior is dictated by execve, which is currently used. The solution is to use execvpe instead. But it contains a potential vulnerability.

The execlp(), execvp(), and execvpe() functions duplicate the actions of the shell in searching for an executable file if the specified filename does not contain a slash (/) character. The file is sought in the colon-separated list of directory pathnames specified in the PATH environment variable. If this variable isn't defined, the path list defaults to the current directory followed by the list of directories returned by confstr(_CS_PATH). (This confstr(3) call typically returns the value "/bin:/usr/bin".)

If PATH is not defined (which is quite an exotic situation), then execvpe looks in the current directory.

The following logic is suggested:

if (!path.contains('/') && !env.contains("PATH")) {
  throw ...
}
execvpe

Internal issue: TAXICOMMON-8853

@Anton3 Anton3 added good first issue Good small issue for newcomers help wanted We would appreciate PR labels May 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
good first issue Good small issue for newcomers help wanted We would appreciate PR
Projects
None yet
Development

No branches or pull requests

1 participant