1923778 - Perl now considers an empty PATH to be insecure, whether it's detainted or not

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, defect)

Description

[Dave Miller [:justdave]]

Not sure when this change happened in Perl itself, but the documentation just got updated to mention it this last month:
https://www.nntp.perl.org/group/perl.perl5.changes/2024/09/msg63655.html

The version of Perl that ships in Ubuntu 24.04 now chokes on PATH being empty in Taint mode.

This breaks sending email via SMTP since Email::Sender tries to run the hostname command while doing its business.

~> lsb_release -d
No LSB modules are available.
Description:	Ubuntu 24.04.1 LTS
~> perl -e 'print "$^V\n";'
v5.38.2
~> perl -T
# test empty PATH
$ENV{PATH}='';
my $foo = `hostname --fqdn`;
print "$foo\n";
^D
Insecure directory in $ENV{PATH} while running with -T switch at - line 2.
~> perl -T
# test explicit PATH
$ENV{PATH}='/bin:/usr/bin';
my $foo = `hostname --fqdn`;
print "$foo\n";
^D
ubuntu
~> perl -T
# test deleted PATH
delete $ENV{PATH};
my $foo = `hostname --fqdn`;
print "$foo\n";
^D
ubuntu
~>

The relevant code in Bugzilla is here:
https://github.com/bugzilla/bugzilla/blob/release-5.2/Bugzilla.pm#L86-L113

We currently set PATH to an empty string on every page load. We used to delete it, but changed that because some of our dependencies apparently choked on it not existing.

We either need to go back to deleting it (which works, per my example above), or set it to something explicit and sane on the given platform (which means finding sane values for each platform).

Comment 1

[Ben]

Here are some technical details from the incident. The bugzilla version is 5.2 and is configured to send emails using SMTP. When a change is made to a bug that causes an email to be send, the browser web page would display this error in the browser:

Software error:
Insecure directory in $ENV{PATH} while running with -T switch at /usr/share/perl5/Sys/Hostname/Long.pm line 82.
For help, please send mail to the webmaster (xxxxx), giving this error message and the time and date of the error

For each incident the apache2 errorlog contains a line like this:

[Wed Oct 9 19:24:27 2024] process_bug.cgi: Insecure directory in $ENV{PATH} while running with -T switch at /usr/share/perl5/Sys/Hostname/Long.pm line 82.

The bugzilla error log does not contain anything for this.

Bugs would still be updated, so if you went back to the bug that caused the error, the comment you added would be there.

The problem started to manifest after upgrading the operating system from Ubuntu LTS 20.04 to 24.04.1 LTS.

The machine is essentially an Ubuntu server version with a minimal XFCE GUI added. Other than that, it contains nothing other than what is needed for bugzilla, no additional third party or custom installations. No custom sources or versions.

perl -v reports: "This is perl 5, version 38, subversion 2 (v5.38.2) built for x86_64-linux-gnu-thread-multi". This is the standard default Perl that comes with Ubuntu. (As of the reporting of this bug the latest Perl version is 5.40.0)

After the upgrade, the bugzilla lib directory was renamed and a new empty lib directory was created. Then checksetup.pl was run and all required and optional modules were installed using the command "cpanm <modulename>".

Dave was able to find the following workaround which seems to fully work around it:

Edit the file bugzilla/Bugzilla.pm and around line 87 change:

my $path = '';

to:

my $path = '/bin:/usr/bin/';

The system default path is:

/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin

Thank you very much Dave, you are a life savior, a true Bugzilla champion.

Comment 2

[Frédéric Buclin]

(In reply to Dave Miller [:justdave] from comment #0)

We currently set PATH to an empty string on every page load. We used to delete it, but changed that because some of our dependencies apparently choked on it not existing.

We either need to go back to deleting it (which works, per my example above), or set it to something explicit and sane on the given platform (which means finding sane values for each platform).

Per comment on line 110 of Bugzilla.pm, some modules such as File::Spec::Win32 do not like an undefined PATH, so you would have to set it to some sensible value depending on the platform it's running on. I already did this when using Strawberry Perl on Windows in bug 987742. Maybe detaint $ENV{PATH} instead of deleting it?

Comment 3

[Dave Miller [:justdave]]

Blindly detainting it defeats the purpose of Perl making this check to begin with. I'm pretty sure everything we shell out to (including send mail) is done with an explicit path, so the content of PATH is irrelevant even if it's invalid. So just setting it to /bin or something should be plenty.

Comment 5

[Dave Miller [:justdave]]

There's enough people trying to run Bugzilla with a modern Perl that we really need to get 5.2.1 out the door with this in it. Guess I know what I'm doing this weekend.

Comment 6

[Dave Miller [:justdave]]

This does not affect Harmony, as Harmony appears to have opted for manually setting the PATH to the directory containing the binary it's shelling out to in front of each internal invocation, and locally setting a defined path around calls to Email::Sender, so removing from the 5.9.2 blocker list.

Comment 7

[Dave Miller [:justdave]]

This does affect the 5.3 branch, and given that things actually break in newer Perl we should probably take it there.

Comment 8

[BMO Github Automation]

Attachment: [bugzilla/bugzilla] [5.0.4] Bug 1923778: Newer Perl hates PATH being empty (#222)

Comment 9

[BMO Github Automation]

Attachment: [bugzilla/bugzilla] [5.2] Bug 1923778: Newer Perl hates PATH being empty (#223)

Comment 10

[BMO Github Automation]

Attachment: [bugzilla/bugzilla] [5.3] Bug 1923778: Newer Perl hates PATH being empty (#224)

Comment 11

[Dave Miller [:justdave]]

Comment on attachment 9600175 [details] [review]
[bugzilla/bugzilla] [5.0.4] Bug 1923778: Newer Perl hates PATH being empty (#222)

GH Automation duplicated again.

Comment 12

[Frédéric Buclin]

Comment on attachment 9600174 [details] [review]
[bugzilla/bugzilla] [5.0.4] Bug 1923778: Newer Perl hates PATH being empty (#222)

I'm against these padding changes on the 5.0.4 branch. This breaks existing customizations.

Comment 13

[Dave Miller [:justdave]]

Comment on attachment 9600174 [details] [review]
[bugzilla/bugzilla] [5.0.4] Bug 1923778: Newer Perl hates PATH being empty (#222)

(In reply to Frédéric Buclin from comment #12)

I'm against these padding changes on the 5.0.4 branch. This breaks existing customizations.

The unintentional padding changes were removed.

Comment 14

[Dave Miller [:justdave]]

Comment on attachment 9600174 [details] [review]
[bugzilla/bugzilla] [5.0.4] Bug 1923778: Newer Perl hates PATH being empty (#222)

https://github.com/bugzilla/bugzilla/commit/25bac3d65787507c5eacbf8324d33be41f2b91da

Comment 15

[Dave Miller [:justdave]]

Comment on attachment 9600176 [details] [review]
[bugzilla/bugzilla] [5.2] Bug 1923778: Newer Perl hates PATH being empty (#223)

https://github.com/bugzilla/bugzilla/commit/c377c05a8febca9e8ffa15817846ed5b6082e9c3

Comment 16

[Dave Miller [:justdave]]

Comment on attachment 9600177 [details] [review]
[bugzilla/bugzilla] [5.3] Bug 1923778: Newer Perl hates PATH being empty (#224)

https://github.com/bugzilla/bugzilla/commit/3d9564fd8357791c2761d39a862df9730b3d6031