[Rpm-maint] [rpm-software-management/rpm] Prevent command injection via rpmbuild -t (PR #4317)

[Michal Domonkos]

@dmnks commented on this pull request.



> @@ -885,6 +885,20 @@ runroot rpm -q --qf "%{packager}\n" /build/SRPMS/hello-2.0-1.src.rpm
 [])
 RPMTEST_CLEANUP
 
+RPMTEST_SETUP_RW([rpmbuild -ts <spec> (evil)])
+AT_KEYWORDS([build])
+RPMTEST_CHECK([
+
+runroot /data/misc/CVE-2026-78367.py
+runroot --setenv RPM_POC_PATH /tmp/gotcha \
+	rpmbuild --quiet -ts evil.tar.gz
+test -f $RPMTEST/tmp/gotcha

Oh yep, I noticed this myself too but then hand-waived it...

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/4317#discussion_r3901848632
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/pull/4317/review/5075288506 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20260901/4b1739b4/attachment-0001.htm>