From b20626fb7c10b1daf5d14460b3f35435157cfef0 Mon Sep 17 00:00:00 2001 From: Jacob Bachmeyer Date: Sat, 1 Apr 2023 20:14:16 -0500 Subject: [PATCH] Handle tainted values if --with-gpgv or --with-lsof options are used --- gatekeeper.pl | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/gatekeeper.pl b/gatekeeper.pl index 04f82c5..9cfd6ff 100755 --- a/gatekeeper.pl +++ b/gatekeeper.pl @@ -238,8 +238,7 @@ BEGIN { my $want_version = ''; my $ConfigFile = File::Spec->catfile($FindBin::Bin, 'gatekeeper.conf'); - my $GPGV_Bin = '/usr/bin/gpgv'; - my $LSOF_Bin = '/usr/bin/lsof'; + my $GPGV_Bin; my $LSOF_Bin; # Set this to 1 or higher to get debug output in the log file. my $DEBUG = 1; @@ -296,8 +295,19 @@ BEGIN { constant->import(FTPINDEX_TOOL => File::Spec->catfile($1, 'make-ftpindex.sh')); - constant->import(GPGV_BIN => $GPGV_Bin); - constant->import(LSOF_BIN => $LSOF_Bin); + if (defined $GPGV_Bin) { + $GPGV_Bin =~ m[^/([[:graph:] ]+[^/])$] + or die "--with-gpgv requires a reasonable absolute file name"; + -f $1 && -x _ or die "--with-gpgv must name an executable file"; + constant->import(GPGV_BIN => $1); + } else { constant->import(GPGV_BIN => '/usr/bin/gpgv') } + + if (defined $LSOF_Bin) { + $LSOF_Bin =~ m[^/([[:graph:] ]+[^/])$] + or die "--with-lsof requires a reasonable absolute file name"; + -f $1 && -x _ or die "--with-lsof must name an executable file"; + constant->import(LSOF_BIN => $1); + } else { constant->import(LSOF_BIN => '/usr/bin/lsof') } } # declare variables used to initialize constants -- 2.25.1