Skip to content

Commit ce6ab75

Browse files
Peter HueneMoses Mendoza
authored andcommitted
(FACT-480) Remove current directory from Ruby load path.
The current directory ('.') is on the load path for Ruby 1.8.7. This is a security vulnerability as it allows arbitrary code loading if users create ruby source files with names that correspond to those that facter is trying to load. The fix is to explicitly remove '.' from the load path before any code is loaded by facter.
1 parent 4961ef5 commit ce6ab75

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

bin/facter

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
#!/usr/bin/env ruby
22

3+
# For security reasons, ensure that '.' is not on the load path
4+
# This is primarily for 1.8.7 since 1.9.2+ doesn't put '.' on the load path
5+
$LOAD_PATH.delete '.'
6+
37
# Bundler and rubygems maintain a set of directories from which to
48
# load gems. If Bundler is loaded, let it determine what can be
59
# loaded. If it's not loaded, then use rubygems. But do this before

0 commit comments

Comments
 (0)