From 1b5c0ed16deeb30286c0fea3e02ea332ba6c4633 Mon Sep 17 00:00:00 2001
From: "Kyle J. McKay" <mackyle@gmail.com>
Date: Sun, 7 Feb 2021 08:38:17 -0700
Subject: [PATCH] install.sh: validate paths used when preprocessing scripts

Add an initial check to validate that all the paths used to identify
scripts being preprocessed are absolute paths.  This also allows
them to be laundered of any taint at the same time.

Signed-off-by: Kyle J. McKay <mackyle@gmail.com>
---
 install.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/install.sh b/install.sh
index 687049f..4a70841 100755
--- a/install.sh
+++ b/install.sh
@@ -741,6 +741,7 @@ echo "*** Preprocessing scripts..."
 SHBIN="$shbin" && export SHBIN
 PERLBIN="$perlbin" && export PERLBIN
 perl -I"$PWD" -M$GIROCCO_CONF -MGirocco::Validator -i -p \
+	-e 'BEGIN {my @a; m|^(/.+)$| && push(@a, $1) or die "bad path: $_" for @ARGV; @ARGV=@a}' \
 	-e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 	-e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 	-e 's/(?<!")\@basedir\@/"$Girocco::Config::basedir"/g;' \
@@ -774,15 +775,18 @@ perl -I"$PWD" -M$GIROCCO_CONF -MGirocco::Validator -i -p \
 	"$basedir"/bin/create-* "$basedir"/bin/update-* \
 	"$basedir"/bin/*.cgi "$basedir"/screen/*
 perl -I"$PWD" -M$GIROCCO_CONF -MGirocco::Validator -i -p \
+	-e 'BEGIN {my @a; m|^(/.+)$| && push(@a, $1) or die "bad path: $_" for @ARGV; @ARGV=@a}' \
 	-e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 	"$basedir"/cgi/*.cgi "$basedir"/gitweb/*.perl \
 	"$basedir"/jobd/*.pl "$basedir"/taskd/*.pl
 perl -i -p \
+	-e 'BEGIN {my @a; m|^(/.+)$| && push(@a, $1) or die "bad path: $_" for @ARGV; @ARGV=@a}' \
 	-e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 	-e 'close ARGV if eof;' \
 	"$basedir"/jobd/jobd.pl "$basedir"/taskd/taskd.pl \
 	"$basedir"/bin/sendmail.pl "$basedir"/bin/CACreateCert
 perl -i -p \
+	-e 'BEGIN {my @a; m|^(/.+)$| && push(@a, $1) or die "bad path: $_" for @ARGV; @ARGV=@a}' \
 	-e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 	-e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 	-e 'close ARGV if eof;' \
-- 
2.11.4.GIT