Bug #10066: File.expand_path performs poor validation of absolute path

• Status: Rejected
• Assignee: -
• Target version: -
• ruby -v: ruby 2.2.0dev (2014-07-19 trunk 46871) [x86_64-linux]
• Backport: 2.0.0: UNKNOWN, 2.1: UNKNOWN

[lavamunky (Peter Blay)]

With File.expand_path(), if one of the arguments is of the form "~/.*", then it will search for the environment variable $HOME. If this is set to:

export HOME="/home/peter"

Then searching for File.expand_path '~/.bashrc' works as expected. If the variable is specified as:

export HOME="ls -la / #"

Then File.expand_path '~/.bashrc' works as expected and raises an ArgumentError for a non-absolute home. However this performs a poor validation on the environment variable, as this works around the issue:

export HOME="/bin/bash -c \"ls -la /\" #/home/peter"

From here File.expand_path '~/.bashrc' returns:

"/bin/bash -c \"ls -la /\" #/home/peter/.bashrc"

This potentially enables various security vulnerabilities such as command injection above, if this is passed to a function that runs commands, or could potentially allow an attacker other means of attack on privilege escalation, or to change other values within an application.
Please note that this affects both arguments for File.expand_path()

[nobu (Nobuyoshi Nakada)]

• Description updated (diff)
• Status changed from Open to Rejected

It's a valid path, and File.expand_path() doesn't reject non-existent pathes.