[Rpm-maint] [rpm-software-management/rpm] Prevent command injection via rpmbuild -t (PR #4317)

[Panu Matilainen]

@pmatilai commented on this pull request.



> @@ -885,6 +885,20 @@ runroot rpm -q --qf "%{packager}\n" /build/SRPMS/hello-2.0-1.src.rpm
 [])
 RPMTEST_CLEANUP
 
+RPMTEST_SETUP_RW([rpmbuild -ts <spec> (evil)])
+AT_KEYWORDS([build])
+RPMTEST_CHECK([
+
+runroot /data/misc/CVE-2026-78367.py
+runroot --setenv RPM_POC_PATH /tmp/gotcha \
+	rpmbuild --quiet -ts evil.tar.gz
+test -f $RPMTEST/tmp/gotcha

Better to split the final test into a separate RPMTEST_CHECK, because this merrily pass in case the rpmbuild step quietly fails to produce anything at all.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/4317#pullrequestreview-5074880855
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/pull/4317/review/5074880855 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20260831/11a2937d/attachment.htm>