{"action":"created","issue":{"url":"https://api.github.com/repos/torhve/weechat-matrix-protocol-script/issues/57","repository_url":"https://api.github.com/repos/torhve/weechat-matrix-protocol-script","labels_url":"https://api.github.com/repos/torhve/weechat-matrix-protocol-script/issues/57/labels{/name}","comments_url":"https://api.github.com/repos/torhve/weechat-matrix-protocol-script/issues/57/comments","events_url":"https://api.github.com/repos/torhve/weechat-matrix-protocol-script/issues/57/events","html_url":"https://github.com/torhve/weechat-matrix-protocol-script/pull/57","id":199358946,"number":57,"title":"Use full path for curl to prevent bugs or code execution in case $PATH would be overwritten","user":{"login":"vbrandl","id":20639051,"avatar_url":"https://avatars1.githubusercontent.com/u/20639051?v=4","gravatar_id":"","url":"https://api.github.com/users/vbrandl","html_url":"https://github.com/vbrandl","followers_url":"https://api.github.com/users/vbrandl/followers","following_url":"https://api.github.com/users/vbrandl/following{/other_user}","gists_url":"https://api.github.com/users/vbrandl/gists{/gist_id}","starred_url":"https://api.github.com/users/vbrandl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vbrandl/subscriptions","organizations_url":"https://api.github.com/users/vbrandl/orgs","repos_url":"https://api.github.com/users/vbrandl/repos","events_url":"https://api.github.com/users/vbrandl/events{/privacy}","received_events_url":"https://api.github.com/users/vbrandl/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-01-07T12:29:23Z","updated_at":"2017-07-20T17:08:10Z","closed_at":"2017-01-21T12:05:30Z","pull_request":{"url":"https://api.github.com/repos/torhve/weechat-matrix-protocol-script/pulls/57","html_url":"https://github.com/torhve/weechat-matrix-protocol-script/pull/57","diff_url":"https://github.com/torhve/weechat-matrix-protocol-script/pull/57.diff","patch_url":"https://github.com/torhve/weechat-matrix-protocol-script/pull/57.patch"},"body":"When invoking OS commands, one should always use the full path to the binary. If someone were able to overwrite $PATH, he could achieve code execution, when placing another `curl` binary in another path"},"comment":{"url":"https://api.github.com/repos/torhve/weechat-matrix-protocol-script/issues/comments/316769245","html_url":"https://github.com/torhve/weechat-matrix-protocol-script/pull/57#issuecomment-316769245","issue_url":"https://api.github.com/repos/torhve/weechat-matrix-protocol-script/issues/57","id":316769245,"user":{"login":"brycied00d","id":435838,"avatar_url":"https://avatars0.githubusercontent.com/u/435838?v=4","gravatar_id":"","url":"https://api.github.com/users/brycied00d","html_url":"https://github.com/brycied00d","followers_url":"https://api.github.com/users/brycied00d/followers","following_url":"https://api.github.com/users/brycied00d/following{/other_user}","gists_url":"https://api.github.com/users/brycied00d/gists{/gist_id}","starred_url":"https://api.github.com/users/brycied00d/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brycied00d/subscriptions","organizations_url":"https://api.github.com/users/brycied00d/orgs","repos_url":"https://api.github.com/users/brycied00d/repos","events_url":"https://api.github.com/users/brycied00d/events{/privacy}","received_events_url":"https://api.github.com/users/brycied00d/received_events","type":"User","site_admin":false},"created_at":"2017-07-20T17:08:09Z","updated_at":"2017-07-20T17:08:09Z","body":"No no no no no, this is bad, this is wrong. `$PATH` exists explicitly for this purpose, to define where in the environment executables are to be found. \r\n\r\n> When invoking OS commands, one should always use the full path to the binary.\r\n\r\n1. This is not an \"OS command,\" it's an executable provided by a package.\r\n2. As I led with, one should [almost] NEVER use the full path to the binary. The path to a given binary should be left to the shell to seek, with precedence set by the order of `$PATH`.\r\n\r\n> If someone were able to overwrite $PATH, he could achieve code execution, when placing another curl binary in another path\r\n\r\nIf someone is able to overwrite your `$PATH` then either they're the system administrator modifying system-wide configurations and probably know better than you where `curl` is located, or they have access to the lua script itself, or they have arbitrary access to the environment in which the script is running in which case they can already almost certainly overwrite the script itself.\r\n\r\nA point of note: Many operating systems install packages and user-compiled binaries into `PREFIX=/usr/local` which will cause this to break (as @regnat mentioned)\r\n\r\nI'm going to open a pullreq reverting this change..."}}
{"actor":{"display_login":"brycied00d"}}