Skip to content

Commit

Permalink
(FACT-480) Remove current directory from Ruby load path.
Browse files Browse the repository at this point in the history
The current directory ('.') is on the load path for Ruby 1.8.7.
This is a security vulnerability as it allows arbitrary code loading if
users create ruby source files with names that correspond to those that
facter is trying to load.

The fix is to explicitly remove '.' from the load path before any code
is loaded by facter.
  • Loading branch information
Peter Huene authored and Moses Mendoza committed Jun 13, 2014
1 parent 4961ef5 commit ce6ab75
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions bin/facter
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
#!/usr/bin/env ruby

# For security reasons, ensure that '.' is not on the load path
# This is primarily for 1.8.7 since 1.9.2+ doesn't put '.' on the load path
$LOAD_PATH.delete '.'

# Bundler and rubygems maintain a set of directories from which to
# load gems. If Bundler is loaded, let it determine what can be
# loaded. If it's not loaded, then use rubygems. But do this before
Expand Down

0 comments on commit ce6ab75

Please sign in to comment.