[Rpm-maint] [rpm-software-management/rpm] Prevent command injection via rpmbuild -t (PR #4317)

coderabbitai[bot] notifications at github.com
Wed Sep 2 07:39:39 UTC 2026 

coderabbitai[bot] left a comment (rpm-software-management/rpm#4317)

<!-- This is an auto-generated comment: summarize by coderabbit.ai -->
<!-- review_stack_entry_start -->

[![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/rpm-software-management/rpm/pull/4317)

<!-- review_stack_entry_end -->
<!-- recent_review_start -->

No actionable comments were generated in the recent review. 🎉

<details>
<summary>ℹ️ Recent review info</summary>

<details>
<summary>⚙️ Run configuration</summary>

**Configuration used**: Repository UI

**Review profile**: CHILL

**Plan**: Team

**Run ID**: `9cd50052-e343-4094-b598-060592888f4b`

</details>

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between a8cd2b77b23acc6a7544564f647b5b23df88bc27 and d831cf569cf1e4e15e0b09b5c79b6887c110392b.

</details>

<details>
<summary>📒 Files selected for processing (4)</summary>

* `build/parseSpec.cc`
* `tests/data/misc/CVE-2026-78367.py`
* `tests/rpmbuild.at`
* `tools/rpmbuild.cc`

</details>

**Included review availability:** Your plan provides up to 4 included reviews per hour; 3 remain after this review.

</details>

---



<!-- recent_review_end -->
<!-- walkthrough_start -->

<details>
<summary>📝 Walkthrough</summary>

## Walkthrough

The change updates tar spec path handling. `getTarSpec` derives the final spec filename from the tar member basename and `%{_specdir}`. `parseSpec` normalizes the spec path with `rpmCleanPath`. A Python proof-of-concept generator and an autotest cover a crafted archive case. The test expects `rpmbuild -ts` to exit with status 1 and create `/tmp/gotcha`.

**Suggested reviewers:** `pmatilai`, `sleedsurfer`

</details>

<!-- walkthrough_end -->
<!-- final_review_risk_start -->
**Merge Risk:** _🔵 Low_ · up to `d831c`

The change prevents archive-derived filenames from being macro-expanded, reducing command-injection exposure. The regression test should separately verify rpmbuild's failure status and the marker file's absence, so merge is reasonable with owner awareness of this test-quality issue.
<!-- final_review_risk_end -->
<!-- pre_merge_checks_walkthrough_start -->

<details>
<summary>🚥 Pre-merge checks | ✅ 4 | ❌ 1</summary>

### ❌ Failed checks (1 warning)

|     Check name     | Status     | Explanation                                                                                                                                                                                               | Resolution                                                                         |
| :----------------: | :--------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------- |
| Docstring Coverage | ⚠️ Warning | Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files. (1 skipped: 1… | Write docstrings for the functions missing them to satisfy the coverage threshold. |

<details>
<summary>✅ Passed checks (4 passed)</summary>

|         Check name         | Status   | Explanation                                                                                              |
| :------------------------: | :------- | :------------------------------------------------------------------------------------------------------- |
|      Description check     | ✅ Passed | The description clearly explains the command-injection risk, the corrective changes, and the added test. |
|         Title check        | ✅ Passed | The title clearly and concisely identifies the primary security fix in rpmbuild -t.                      |
|     Linked Issues check    | ✅ Passed | Check skipped because no linked issues were found for this pull request.                                 |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request.                                 |

</details>

<details>
<summary>Full details: Docstring Coverage</summary>

**Explanation**

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files. (1 skipped: 1 unsupported.)

</details>

</details>

<!-- pre_merge_checks_walkthrough_end -->
<!-- tips_start -->

---

Thanks for using [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=rpm-software-management/rpm&utm_content=4317)! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

<details>
<summary>❤️ Share</summary>

- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai)
- [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai)
- [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai)
- [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)

</details>


<sub>Comment `@coderabbitai help` to get the list of available commands.</sub>

<!-- tips_end -->

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/4317#issuecomment-5506172199
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/pull/4317/c5506172199 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20260902/fdb3e3df/attachment-0001.htm>

More information about the Rpm-maint mailing list