From b3dd05e16d6aa469e708165d3c83bb8b3ee3fbb7 Mon Sep 17 00:00:00 2001 From: Hendrik Brueckner Date: Thu, 9 Jul 2026 14:23:16 +0200 Subject: [PATCH] iucvterm/ts-shell: Add Perl taint tests for auditdir and getpwuid() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The audit directory ts-shell configuration and also the output of getpwuid() are considered tainted when running in Perl taint (-T) mode. Provide untaint checks with validating the content. Reviewed-by: Jan Höppner Signed-off-by: Hendrik Brueckner Signed-off-by: Jan Höppner --- iucvterm/bin/ts-shell.in | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/iucvterm/bin/ts-shell.in b/iucvterm/bin/ts-shell.in index 3e834389..ee98852f 100755 --- a/iucvterm/bin/ts-shell.in +++ b/iucvterm/bin/ts-shell.in @@ -227,6 +227,16 @@ sub checkConfiguration(\%) exit 7; } $cfg->{iucvconn} = $1; + + # Validate transcript-directory to untaint for later use + unless ($cfg->{auditdir} =~ m#^(/[\w./-]+)$#) { + log_error "Invalid transcript-directory configuration"; + exit 8; + } + $cfg->{auditdir} = $1; + + # Untaint user name (tainted by getpwuid) for use in filesystem paths + ($cfg->{user}) = ($cfg->{user} =~ /^([\w.-]+)$/); } # loadAuthorization() - Load system authorizations from file