pyenv glob expansion and IFS handling vulnerability fix

Vulnerability Overview The webpage screenshot displays a code commit related to the project, primarily involving modifications to the scripts. These changes aim to address issues associated with version management and path handling, specifically potential vulnerabilities related to glob expansion and IFS (Internal Field Separator) processing. Impact Scope Affected Files: , , , , , , , , , , , , , . Impacted Functionality: Functions such as 's version management, path resolution, and version selection may be affected by improper glob expansion and IFS handling, leading to incorrect version selection or path resolution errors. Remediation 1. : - Modified the usage of and to ensure IFS is handled correctly after glob expansion. - Added and to disable and enable glob expansion, preventing unnecessary glob expansion. 2. : - Similarly, modified the usage of and to ensure IFS is handled correctly after glob expansion. - Added and to disable and enable glob expansion. 3. : - Modified the handling of to ensure IFS is handled correctly after glob expansion. - Added and to disable and enable glob expansion. 4. : - Modified the handling of to ensure IFS is handled correctly after glob expansion. - Added and to disable and enable glob expansion. 5. : - Modified the handling of to ensure IFS is handled correctly after glob expansion. - Added and to disable and enable glob expansion. 6. : - Modified the handling of to ensure IFS is handled correctly after glob expansion. - Added and to disable and enable glob expansion. 7. : - Modified the handling of to ensure IFS is handled correctly after glob expansion. - Added and to disable and enable glob expansion. 8. Test Files: - Updated multiple test files ( , , , , , , ) to verify that the above modifications correctly handle glob expansion and IFS issues. POC Code or Exploit Code No specific POC code or exploit code is provided in the page; however, detailed code modifications and test cases are included, demonstrating how to fix potential vulnerabilities related to glob expansion and IFS handling. bash VAR() of unquoted value does glob expansion (against the current dir's contents) after IFS-splitting which is undesired set -f IFS=: versions=$( pyenv-version-file-read "$PYENV_VERSION_FILE" pyenv-version-file-read "$PYENV_ROOT/global" pyenv-version-file-read "$PYENV_ROOT/default" echo system ) set +f bash VAR() of unquoted value does glob expansion (against the current dir's contents) after IFS-splitting which is undesired set -f IFS=: versions=$(pyenv-version-file-read "$version_file") set +f bash Unquoted $VAR does glob expansion (against the current dir's contents) after IFS-splitting which is undesired set -f for version in $(PYENV_VERSION); do if [ "$version" = "system" ]; then if PYTHON_PATH=$(PYENV_VERSION="$version" pyenv-which python --skip-advice 2>/dev/null); then \ OLDIFS="$IFS" exit 1 fi done set +f IFS="$OLDIFS" bash VAR() of unquoted value does glob expansion (against the current dir's contents) after IFS-splitting which is undesired set -f IFS=: PYENV_VERSION_NAMES=$(pyenv-version-name) set +f bash Unquoted $VAR does glob expansion (against the current dir's contents) after IFS-splitting which is undesired set -f for version in $(PYENV_VERSION); do Remove the explicit "python-" prefix from versions like "python-3.12". normalised_version=$(strip_python_prefix) done set +f bash VAR() of unquoted value does glob expansion (against the current dir's contents) after IFS-splitting which is undesired set -f if ((${BASH_VERSION%%.} >= 4)); then for i in $(pyenv-version-name current_versions["$i"]="1" done else current_versions=$(pyenv-version-name fi set +f bash Unquoted $VAR or VAR() of unquoted value does glob expansion (against the current dir's contents) after IFS-splitting which is undesired set -f IFS=: versions=$(PYENV_VERSION=$(pyenv-version-name -f)) set +f bash @test "version with glob characters is handled correctly" { touch 1.1 mkdir -p "$PYENV_ROOT" echo "[1-9]." > "$PYENV_ROOT/version" run pyenv-global assert_success "[1-9]." } bash @test "version with glob characters is handled correctly" { touch 1.1 echo "[1-9]." > .python-version run pyenv-local assert_success "[1-9]." } bash @test "version with glob characters is handled correctly" { touch 1.1 PYENV_VERSION="[1-9]." run pyenv-prefix assert_failure "pyenv: version [1-9].' is not installed (set by PYENV_VERSION environment variable) } bash @test "version with glob characters is handled correctly" { stub_system_python create_version "[1-9]." touch 1.1 run pyenv-versions assert_success assert_output "" system (set by $PYENV_ROOT/version) [1-9]. } bash @test "version with glob characters is handled correctly" { bats_require_minimum_version 1.5.0 PATH=$(path_without foo) PYENV_VERSION="[1-9].*" run -127 pyenv-which foo assert_failure assert_output "" pyenv: version ``

Goal Reached Thanks to every supporter — we hit 100%!

pyenv glob expansion and IFS handling vulnerability fix

More from this source