diff options
| author | Daniel Golle | 2026-02-06 11:01:29 +0000 |
|---|---|---|
| committer | Daniel Golle | 2026-02-09 11:37:13 +0000 |
| commit | e08cdc8562f55b9ac228a21f3f7605a18c522b81 (patch) | |
| tree | 90a3b27f7255b03a149aa1a2fabb815333dcdfa4 | |
| parent | afa4391d9cbb0706bbae9c8345436fa6d99c3013 (diff) | |
hotplug-dispatch: fix filter disallowing setting PATH
Due to a bug in hotplug-dispatch, the PATH env variable wasn't
filtered, allowing authrorized callers the execution of commands
via PATH environment variable filter bypass.
Replace the call to strcmp with strncmp and limit the comparision
to 5 characters to account for each character in "PATH=".
Fixes: TOB-OWRT-4
Fixes: 08938fe ("procd: add hotplug-call dispatcher")
Reported-by: Trail of Bits (@trailofbits)
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
| -rw-r--r-- | hotplug-dispatch.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hotplug-dispatch.c b/hotplug-dispatch.c index f048fcb..a67ef2d 100644 --- a/hotplug-dispatch.c +++ b/hotplug-dispatch.c @@ -232,7 +232,7 @@ static int hotplug_call(struct ubus_context *ctx, struct ubus_object *obj, if (!strncmp(enve, "LD_", 3)) continue; - if (!strcmp(enve, "PATH")) + if (!strncmp(enve, "PATH=", 5)) continue; if (strlen(enve) < 3) |