From f216862052094933f28ce87bba1488853a7d9ed7 Mon Sep 17 00:00:00 2001
From: Hendrik Brueckner <brueckner@linux.ibm.com>
Date: Thu, 9 Jul 2026 18:32:49 +0200
Subject: [PATCH] iucvterm/ts-shell: Split reading and checking configuration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The updateConfiguration() function updates and checks the ts-shell
configuration for each line in the ts-shell configuration file.

Run the checks just once after the configuration is completely read.

Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
---
 iucvterm/bin/ts-shell.in | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/iucvterm/bin/ts-shell.in b/iucvterm/bin/ts-shell.in
index d9ac7550..3e834389 100755
--- a/iucvterm/bin/ts-shell.in
+++ b/iucvterm/bin/ts-shell.in
@@ -71,6 +71,7 @@ sub cmd_list(\%);
 sub rl_cmd_completion($$$);
 sub list_regex_match($);
 sub updateConfiguration(\%$);
+sub checkConfiguration(\%);
 sub loadAuthorization(\%);
 sub readFile($$);
 sub log_debug($);
@@ -109,6 +110,7 @@ sub main()
 			  "$config{conffile} failed: $!";
 		exit 3;
 	}
+	checkConfiguration(%config);
 
 	# load list of systems the ts-shell is allowed to use; and
 	# hash the systems names in uppercase
@@ -191,13 +193,26 @@ sub updateConfiguration(\%$)
 {
 	my ($cfg, $line) = @_;
 	my ($option, $value) = split /\s*=\s*/, $line;
-	
+
 	$cfg->{sysfile}   = $value if $option =~ /^ts-systems$/;
 	$cfg->{authfile}  = $value if $option =~ /^ts-authorization$/;
 	$cfg->{auditdir}  = $value if $option =~ /^transcript-directory$/;
 	$cfg->{auditfile} = $value if $option =~ /^transcript-systems$/;
 	$cfg->{pager}     = $value if $option =~ /^pager$/;
 	$cfg->{iucvconn}  = $value if $option =~ /^iucvconn$/;
+}
+
+# checkConfiguration() - Validate and untaint configuration values
+#
+# Called once after readFile() has finished populating %cfg from
+# ts-shell.conf.  Validates each security-sensitive path and untaints
+# it via a regex capture so Perl taint mode permits later filesystem use.
+#
+# %cfg:	Hash reference to terminal server configuration
+#
+sub checkConfiguration(\%)
+{
+	my $cfg = shift;
 
 	# Validate pager to untaint for later use
 	unless ($cfg->{pager} =~ m#^(/[\w./-]+)$#) {