github-mirror/fish-shell
2
0
Fork 0
mirror of https://github.com/fish-shell/fish-shell.git synced 2025-01-19 19:22:45 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

avoid symlink attacks in __fish_print_packages and spawning fishd

Browse Source 
* use $XDG_CACHE_HOME for __fish_print_packages completion caches
 * when starting fishd, redirect fishd output to /dev/null, not a
   predictable path

Fix for CVE-2014-3219.

Closes #1440.
This commit is contained in:
David Adam 2014-04-28 23:37:02 +08:00
parent 6596d91c82
commit 3225d7e169
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
env.cpp
View File

@ -58,7 +58,7 @@
#include "fish_version.h"
/** Command used to start fishd */
#define FISHD_CMD L"fishd ^ /tmp/fishd.log.%s"
#define FISHD_CMD L"fishd ^ /dev/null"
// Version for easier debugging
//#define FISHD_CMD L"fishd"

12
share/functions/__fish_print_packages.fish
View File

@ -12,6 +12,12 @@ function __fish_print_packages
#Get the word 'Package' in the current language
set -l package (_ Package)
# Set up cache directory
if test -z "$XDG_CACHE_HOME"
set XDG_CACHE_HOME $HOME/.cache
end
mkdir -m 700 -p $XDG_CACHE_HOME
if type -f apt-cache >/dev/null
# Do not generate the cache as apparently sometimes this is slow.
# http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=547550
@ -31,7 +37,7 @@ function __fish_print_packages
# Caches for 5 minutes
if type -f pacman >/dev/null
set cache_file /tmp/.pac-cache.$USER
set cache_file $XDG_CACHE_HOME/.pac-cache.$USER
if test -f $cache_file
cat $cache_file
set age (math (date +%s) - (stat -c '%Y' $cache_file))
@ -51,7 +57,7 @@ function __fish_print_packages
# If the cache is less than six hours old, we do not recalculate it
set cache_file /tmp/.yum-cache.$USER
set cache_file $XDG_CACHE_HOME/.yum-cache.$USER
if test -f $cache_file
cat $cache_file
set age (math (date +%s) - (stat -c '%Y' $cache_file))
@ -73,7 +79,7 @@ function __fish_print_packages
# If the cache is less than five minutes old, we do not recalculate it
set cache_file /tmp/.rpm-cache.$USER
set cache_file $XDG_CACHE_HOME/.rpm-cache.$USER
if test -f $cache_file
cat $cache_file
set age (math (date +%s) - (stat -c '%Y' $cache_file))