commit: adc977d92024b6bf88e808e5e11a5c4cfc0226b1
Author: Kerin Millar <kfm <AT> plushkava <DOT> net>
AuthorDate: Mon Jul 7 12:30:25 2025 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Sun Jul 13 04:19:04 2025 +0000
URL: https://gitweb.gentoo.org/proj/portage.git/commit/?id=adc977d9
ebuild.sh: rectify a format string injection
Presently, the "ebuild.sh" utility contains a routine that merges the
values of the 'SANDBOX_DENY', 'SANDBOX_PREDICT', 'SANDBOX_READ' and
'SANDBOX_WRITE' variables with those of their counterparts that are
prefixed with "PORTAGE_". In the course of doing so, it directly injects
arbitrary pathnames into the format string given to an invocation of the
printf builtin. Refrain from doing so.
Fixes: 078abd42ede4b69f618b67c86a698030fe9d3c3b
Signed-off-by: Kerin Millar <kfm <AT> plushkava.net>
Signed-off-by: Sam James <sam <AT> gentoo.org>
bin/ebuild.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/bin/ebuild.sh b/bin/ebuild.sh
index a7f67a89b0..c81f4436e1 100755
--- a/bin/ebuild.sh
+++ b/bin/ebuild.sh
@@ -582,7 +582,7 @@ then
export ${x}="${!y}"
elif [[ -n "${!y}" && "${!y}" != "${!x}" ]]; then
# Filter out dupes
- export ${x}="$(printf "${!y}:${!x}" | tr ":" "\0" | \
+ export ${x}="$(printf '%s:%s' "${!y}" "${!x}" | tr ":"
"\0" | \
sort -z -u | tr "\0" ":")"
fi
export ${x}="${!x%:}"
