445804 - Suggested crontab configuration opens security hole

Status: RESOLVED FIXED

(Bugzilla :: Documentation, defect)

Description

[Wesley W. Garland]

Section 2.3.1, Bug Graphs in extraconfig.html suggests the following crontab entry:

cd <your-bugzilla-directory> ; ./collectstats.pl

This opens up a minor security hole, where an arbitrary executable named collectstats.pl could be run from another location (potentially the directory crond was manually launched from) when "your-bugzilla-directory" is not findable for some condition. (i.e. bugzilla de-install, NFS failure, permissions)

The fix is trivial:

cd <your-bugzilla-directory> && ./collectstats.pl

This entry will only run collectstats.pl to run if chdir succeeds.

Comment 1

[Frédéric Buclin]

Well, that'a not a big deal. The one typing the command line is responsible to type the correct path. Not a security bug.

Comment 2

[Rahul]

Sorry to comment on such an old bug report, but the following is important.

Many old shells had special-case code such that if a cd failed, the shell would abort the entire script.

At some point in time, somebody decided that this special case was a bad idea. Modern shells don't have this any more, so far as I can tell.

But many old programming manuals still use this type of code, and many old-timers do this out of habit, because it used to work.

Code examples should, therefore, use the && and not the semicolon, just to remind people that shells are not so fail-safe any more.

I just tested this on SunOS 4.1.3_U1:

# cat x.sh
#! /bin/sh

cd /NONEXISTENT ; echo reached here

echo reached next line
# ./x.sh
./x.sh: /NONEXISTENT: bad directory
#

Comment 3

[Matt Selsky [:selsky]]

Attachment: Use && instead of ;, v1

Comment 4

[Frédéric Buclin]

Committing to: bzr+ssh://[e-mail]/bugzilla/trunk/
modified docs/en/xml/installation.xml
Committed revision 7976.

Committing to: bzr+ssh://[e-mail]/bugzilla/4.2/
modified docs/en/xml/installation.xml
Committed revision 7942.

Committing to: bzr+ssh://[e-mail]/bugzilla/4.0/
modified docs/en/xml/installation.xml
Committed revision 7652.

Committing to: bzr+ssh://[e-mail]/bugzilla/3.6/
modified docs/en/xml/installation.xml
Committed revision 7257.

Committing to: bzr+ssh://[e-mail]/bugzilla/3.4/
modified docs/en/xml/installation.xml
Committed revision 6811.