Bug#605157: calendarserver: Use of PYTHONPATH env var in an insecure way

[Jakub Wilk]

Hi Dmitrijs,

+@@ -145,7 +145,7 @@
+             line = line.rstrip("\n")
+             if fileType == "sh":
+                 if line == "#PYTHONPATH":
+-                    script.append('PYTHONPATH="%s:$PYTHONPATH"' % 
(install_lib,))
++                    script.append('PYTHONPATH="%s:+:$PYTHONPATH"' % 
(install_lib,))
+                 elif line == "#PATH":
+                     script.append('PATH="%s:$PATH"' % (os.path.join(base, 
"bin"),))
+                 else:

This patch looks very suspicious. Have you actually tested it?



--
Jakub Wilk

Besides, as far as I can see, /usr/bin/caldavd doesn't need PYTHONPATH mangling at all.

signature.asc
Description: Digital signature