Exclude working directory from library path (CVE-2016-1238)

Current Perl versions put '.' at the end of the library search path
@INC, although this will be fixed in a future Perl release. This means
that when software loads an optionally-present module, it will be
looked for in the current working directory before giving up. An
attacker could use this to execute arbitrary Perl code from ikiwiki's
current working directory.

Removing '.' from the library search path in Perl is the correct
fix for this vulnerability, but is not trivial to do due to
backwards-compatibility concerns. Mitigate this (even if ikiwiki is run
with a vulnerable Perl version) by explicitly removing '.' from the
search path, and instead looking for ikiwiki's own modules relative
to the absolute path of the executable when run from the source
directory.

In tests that specifically want to use the current working directory,
use "-I".getcwd instead of "-I." so we use its absolute path, which
is immune to the removal of ".".

diff --git a/ikiwiki-calendar.in b/ikiwiki-calendar.in
index 74e100be2e85223d7930b027f2db9c712d8a621e..d3e31b6db0ea204a58f62440316163dbaf515ac1 100755 (executable)
--- a/ikiwiki-calendar.in
+++ b/ikiwiki-calendar.in
@@ -1,7 +1,8 @@
 #!/usr/bin/perl
+no lib '.';
 use warnings;
 use strict;
-use lib '.'; # For use in nonstandard directory, munged by Makefile.
+use FindBin; use lib $FindBin::Bin; # For use in nonstandard directory, munged by Makefile.
 use IkiWiki;
 use IkiWiki::Setup;
 use Getopt::Long;

diff --git a/ikiwiki-comment.in b/ikiwiki-comment.in
index 1c7baead0d6849b223093fd8a75a7470f7a6f11c..174647b0611900346a705d55d6bcd4e579907c89 100755 (executable)
--- a/ikiwiki-comment.in
+++ b/ikiwiki-comment.in
@@ -1,7 +1,8 @@
 #!/usr/bin/perl
+no lib '.';
 use warnings;
 use strict;
-use lib '.'; # For use in nonstandard directory, munged by Makefile.
+use FindBin; use lib $FindBin::Bin; # For use in nonstandard directory, munged by Makefile.
 use IkiWiki;
 use IkiWiki::Plugin::comments;
 use Getopt::Long;

diff --git a/ikiwiki-mass-rebuild b/ikiwiki-mass-rebuild
index 06a9b512b42ca8afc176ad4dfbe7aba8db3506c1..ce4e084e8f0daff8e99e221d6e0027fac70423fb 100755 (executable)
--- a/ikiwiki-mass-rebuild
+++ b/ikiwiki-mass-rebuild
@@ -1,4 +1,5 @@
 #!/usr/bin/perl
+no lib '.';
 use warnings;
 use strict;
 

diff --git a/ikiwiki-transition.in b/ikiwiki-transition.in
index e3be645ccc5e150125ed1ba500f858b044b97eb8..3b617bbfa04c1f365310a29a1abd14723b1b5c73 100755 (executable)
--- a/ikiwiki-transition.in
+++ b/ikiwiki-transition.in
@@ -1,7 +1,8 @@
 #!/usr/bin/perl
+no lib '.';
 use warnings;
 use strict;
-use lib '.'; # For use in nonstandard directory, munged by Makefile.
+use FindBin; use lib $FindBin::Bin; # For use in nonstandard directory, munged by Makefile.
 use IkiWiki;
 use HTML::Entities;
 

diff --git a/ikiwiki-update-wikilist b/ikiwiki-update-wikilist
index 56d6e07319094dcc77d8fea283bcdf4b0b0b734d..2807e6be682e23dc7f29764c2670b890baa42016 100755 (executable)
--- a/ikiwiki-update-wikilist
+++ b/ikiwiki-update-wikilist
@@ -1,6 +1,7 @@
 #!/usr/bin/perl -t
 # Add a user to the system wide wikilist.
 # This script can safely be made suid or put in /etc/sudoers.
+no lib '.';
 use warnings;
 use strict;
 use English;

diff --git a/ikiwiki.in b/ikiwiki.in
index 1327d70e13273f0692ea1b5957063ddaf2a26402..30df628b27d9fda67fbf69ecf17d8ae857edb4f8 100755 (executable)
--- a/ikiwiki.in
+++ b/ikiwiki.in
@@ -1,9 +1,10 @@
 #!/usr/bin/perl
 package IkiWiki;
 
+no lib '.';
 use warnings;
 use strict;
-use lib '.'; # For use in nonstandard directory, munged by Makefile.
+use FindBin; use lib $FindBin::Bin; # For use in nonstandard directory, munged by Makefile.
 use IkiWiki 3.00;
 
 sub usage () {

diff --git a/pm_filter b/pm_filter
index 8e1480564af9400e050c32ed634d6cc1beb64a97..374e9a44fca9ca43233e22e306831dbbc2e6e02c 100755 (executable)
--- a/pm_filter
+++ b/pm_filter
@@ -12,7 +12,7 @@ if (/INSTALLDIR_AUTOREPLACE/) {
 elsif (/VERSION_AUTOREPLACE/) {
        $_=qq{our \$version="$ver";};
 }
-elsif (/^use lib/) {
+elsif (/^(?:use FindBin; *)?use lib/) {
        # The idea here is to figure out if the libdir the Makefile.PL
        # was configured to use is in perl's normal search path.
        # If not, hard code it into ikiwiki.

diff --git a/t/basewiki_brokenlinks.t b/t/basewiki_brokenlinks.t
index 26e3859abedc37b39c70a2bcf40c505751f73455..f639d0dd88abef1477afb738ccc5df6419e165a5 100755 (executable)
--- a/t/basewiki_brokenlinks.t
+++ b/t/basewiki_brokenlinks.t
@@ -1,6 +1,7 @@
 #!/usr/bin/perl
 use warnings;
 use strict;
+use Cwd qw(getcwd);
 use Test::More;
 
 my $installed = $ENV{INSTALLED_TESTS};
@@ -14,10 +15,10 @@ if ($installed) {
 else {
        ok(! system("make -s ikiwiki.out"));
        ok(! system("make underlay_install DESTDIR=`pwd`/t/tmp/install PREFIX=/usr >/dev/null"));
-       @command = qw(env LC_ALL=C perl -I. ./ikiwiki.out
+       @command = (qw(env LC_ALL=C perl), "-I".getcwd, qw(./ikiwiki.out
                --underlaydir=t/tmp/install/usr/share/ikiwiki/basewiki
                --set underlaydirbase=t/tmp/install/usr/share/ikiwiki
-               --templatedir=templates);
+               --templatedir=templates));
 }
 
 foreach my $plugin ("", "listdirectives") {

diff --git a/t/comments.t b/t/comments.t
index a5add970192c953b77c9968ebd0a51cbb4f46755..f2e32c46e9e214e5bbfac8d5f326cba3219d7474 100755 (executable)
--- a/t/comments.t
+++ b/t/comments.t
@@ -1,6 +1,7 @@
 #!/usr/bin/perl
 use warnings;
 use strict;
+use Cwd qw(getcwd);
 use Test::More;
 use IkiWiki;
 
@@ -17,10 +18,10 @@ if ($installed) {
 }
 else {
        ok(! system("make -s ikiwiki.out"));
-       @command = qw(perl -I. ./ikiwiki.out
+       @command = ("perl", "-I".getcwd, qw(./ikiwiki.out
                --underlaydir=underlays/basewiki
                --set underlaydirbase=underlays
-               --templatedir=templates);
+               --templatedir=templates));
 }
 
 my $comment;

diff --git a/t/conflicts.t b/t/conflicts.t
index 07c392cd3a70ae59992f422124814cd21fdd5b32..2c2761efb9e129d68fcfe0547ec34b3e89ca896d 100755 (executable)
--- a/t/conflicts.t
+++ b/t/conflicts.t
@@ -2,6 +2,7 @@
 # Tests for bugs relating to conflicting files in the srcdir
 use warnings;
 use strict;
+use Cwd qw(getcwd);
 use Test::More tests => 106;
 
 my $installed = $ENV{INSTALLED_TESTS};
@@ -13,10 +14,10 @@ if ($installed) {
 }
 else {
        ok(! system("make -s ikiwiki.out"));
-       @command = qw(perl -I. ./ikiwiki.out
+       @command = ("perl", "-I".getcwd, qw(./ikiwiki.out
                --underlaydir=underlays/basewiki
                --set underlaydirbase=underlays
-               --templatedir=templates);
+               --templatedir=templates));
 }
 
 # setup

diff --git a/t/img.t b/t/img.t
index 05a91aff696b1ee51a5e7354c0c92b72ed9a4028..228f09a0e871e534c9bb1b426cf7bb0b20f3a0c7 100755 (executable)
--- a/t/img.t
+++ b/t/img.t
@@ -13,6 +13,7 @@ package IkiWiki;
 
 use warnings;
 use strict;
+use Cwd qw(getcwd);
 use Test::More;
 plan(skip_all => "Image::Magick not available")
        unless eval q{use Image::Magick; 1};
@@ -27,10 +28,10 @@ if ($installed) {
 }
 else {
        ok(! system("make -s ikiwiki.out"));
-       @command = qw(perl -I. ./ikiwiki.out
+       @command = ("perl", "-I".getcwd, qw(./ikiwiki.out
                --underlaydir=underlays/basewiki
                --set underlaydirbase=underlays
-               --templatedir=templates);
+               --templatedir=templates));
 }
 
 push @command, qw(--set usedirs=0 --plugin img t/tmp/in t/tmp/out --verbose);

diff --git a/t/inline.t b/t/inline.t
index 8c0f1c35ab1f4c79f97e0669cdea4ad9cacb2111..3a4450365ff2ed1305a615b827b25802e1e70ec9 100755 (executable)
--- a/t/inline.t
+++ b/t/inline.t
@@ -1,6 +1,7 @@
 #!/usr/bin/perl
 use warnings;
 use strict;
+use Cwd qw(getcwd);
 use Test::More;
 use IkiWiki;
 
@@ -12,10 +13,10 @@ if ($installed) {
 }
 else {
        ok(! system("make -s ikiwiki.out"));
-       @command = qw(perl -I. ./ikiwiki.out
+       @command = ("perl", "-I".getcwd, qw(./ikiwiki.out
                --underlaydir=underlays/basewiki
                --set underlaydirbase=underlays
-               --templatedir=templates);
+               --templatedir=templates));
 }
 
 push @command, qw(--set usedirs=0 --plugin inline

diff --git a/t/meta.t b/t/meta.t
index d23d9bc71a8f1ce7c19510ca492d4733635fb0fa..3b26ee7d2c48f11f0120d3b5935bac13d3c1811c 100755 (executable)
--- a/t/meta.t
+++ b/t/meta.t
@@ -1,6 +1,7 @@
 #!/usr/bin/perl
 use warnings;
 use strict;
+use Cwd qw(getcwd);
 use Test::More;
 use IkiWiki;
 
@@ -16,10 +17,10 @@ if ($installed) {
 }
 else {
        ok(! system("make -s ikiwiki.out"));
-       @command = qw(perl -I. ./ikiwiki.out
+       @command = ("perl", "-I".getcwd, qw(./ikiwiki.out
                --underlaydir=underlays/basewiki
                --set underlaydirbase=underlays
-               --templatedir=templates);
+               --templatedir=templates));
 }
 
 push @command, qw(--plugin meta --disable-plugin htmlscrubber);

diff --git a/t/permalink.t b/t/permalink.t
index edb05a81b1bbdf487aee7b59fff19e6c48fae329..2eb557e1d649c2e5605b76e2285a9dfb2890635e 100755 (executable)
--- a/t/permalink.t
+++ b/t/permalink.t
@@ -1,6 +1,7 @@
 #!/usr/bin/perl
 use warnings;
 use strict;
+use Cwd qw(getcwd);
 use Test::More;
 
 my $installed = $ENV{INSTALLED_TESTS};
@@ -11,10 +12,10 @@ if ($installed) {
 }
 else {
        ok(! system("make -s ikiwiki.out"));
-       @command = qw(perl -I. ./ikiwiki.out
+       @command = ("perl", "-I".getcwd, qw(./ikiwiki.out
                --underlaydir=underlays/basewiki
                --set underlaydirbase=underlays
-               --templatedir=templates);
+               --templatedir=templates));
 }
 
 ok(! system("rm -rf t/tmp"));

diff --git a/t/podcast.t b/t/podcast.t
index c698d1835d5de1fe8ed1345afb87ac3d71c34b0e..708ac7640322f58fbb02d2cca622e6e115325724 100755 (executable)
--- a/t/podcast.t
+++ b/t/podcast.t
@@ -25,10 +25,10 @@ if ($installed) {
 }
 else {
        ok(! system("make -s ikiwiki.out"));
-       @base_command = qw(perl -I. ./ikiwiki.out
+       @base_command = ("perl", "-I".getcwd, qw(./ikiwiki.out
                --underlaydir=underlays/basewiki
                --set underlaydirbase=underlays
-               --templatedir=templates);
+               --templatedir=templates));
 }
 
 my $tmp = 't/tmp';

diff --git a/t/relativity.t b/t/relativity.t
index c67c8ba17cbfb64fceb7b30b658966dfeda92913..7e382eaa7c7c4120727053cff86a730843dc524b 100755 (executable)
--- a/t/relativity.t
+++ b/t/relativity.t
@@ -24,10 +24,10 @@ if ($installed) {
 }
 else {
        ok(! system("make -s ikiwiki.out"));
-       @command = qw(perl -I. ./ikiwiki.out
+       @command = ("perl", "-I".getcwd, qw(./ikiwiki.out
                --underlaydir=underlays/basewiki
                --set underlaydirbase=underlays
-               --templatedir=templates);
+               --templatedir=templates));
 }
 
 sub parse_cgi_content {

diff --git a/t/trail.t b/t/trail.t
index cac64c36628c3bd75147e0e1ccb8d9aa74a5d3fc..ed180d35cd9820537afead9df25c00696a5cc83f 100755 (executable)
--- a/t/trail.t
+++ b/t/trail.t
@@ -1,6 +1,7 @@
 #!/usr/bin/perl
 use warnings;
 use strict;
+use Cwd qw(getcwd);
 use Test::More;
 use IkiWiki;
 
@@ -35,10 +36,10 @@ if ($installed) {
 }
 else {
        ok(! system("make -s ikiwiki.out"));
-       @command = qw(perl -I. ./ikiwiki.out
+       @command = ("perl", "-I".getcwd, qw(./ikiwiki.out
                --underlaydir=underlays/basewiki
                --set underlaydirbase=underlays
-               --templatedir=templates);
+               --templatedir=templates));
 }
 
 push @command, qw(--set usedirs=0 --plugin trail --plugin inline

diff --git a/t/wrapper-environ.t b/t/wrapper-environ.t
index ddf5a6e44f5bf509b1e9b6c2bd65e6a55300bca0..d6d34b9d95156de34364c9e6e2a75960d8659809 100755 (executable)
--- a/t/wrapper-environ.t
+++ b/t/wrapper-environ.t
@@ -22,10 +22,11 @@ if ($installed) {
 }
 else {
        ok(! system("make -s ikiwiki.out"));
-       @command = qw(env PERL5LIB=t/tmp:blib/lib:blib/arch perl -I. ./ikiwiki.out
+       @command = (qw(env PERL5LIB=t/tmp:blib/lib:blib/arch perl),
+               "-I".getcwd, qw(./ikiwiki.out
                --underlaydir=underlays/basewiki
                --set underlaydirbase=underlays
-               --templatedir=templates);
+               --templatedir=templates));
 }
 
 writefile("test.setup", "t/tmp", <<EOF