Merge lp:~cjwatson/click/audit-missing-dot-slash into lp:click/devel
Proposed by
Colin Watson
| Status: | Merged |
|---|---|
| Merged at revision: | 587 |
| Proposed branch: | lp:~cjwatson/click/audit-missing-dot-slash |
| Merge into: | lp:click/devel |
| Diff against target: |
125 lines (+60/-1) 3 files modified
click/install.py (+10/-0) click/tests/test_install.py (+48/-1) debian/changelog (+2/-0) |
| To merge this branch: | bzr merge lp:~cjwatson/click/audit-missing-dot-slash |
| Related bugs: |
| Reviewer | Review Type | Date Requested | Status |
|---|---|---|---|
| Michael Vogt | Approve | ||
|
Review via email:
|
|||
Commit message
Forbid installing packages with data tarball members whose names do not start with "./" (LP: #1506467).
Description of the change
Forbid installing packages with data tarball members whose names do not start with "./". These slipped past the dpkg path filtering because that filtering wasn't built for security purposes and assumes that paths start with "./", starting its comparisons from the second character. To fix this, we audit the file names before invoking dpkg.
To post a comment you must log in.
Looks good, thanks!