Re: question on having . as LOAD_PATH (ruby)
* Junichi Uekawa:
> Hi perl and pyhton people,
>
> Sorry for the crosspost; contrary to what's said in perl-policy and
> python-policy, '.' seems to be included in module search-path. I find
> it uneasy considering we have quite a few tools running as root. Is
> this intentional or unintentional?
One more data point: when running with taint checks enabled, perl
drops "." from the library path. So it seems it's not directly
exploitable with suidperl (unless suidperl invokes further perl
scripts without changing the current directory).
I consider this a security bug, but fixing it (by removing the current
directory from the load path) requires *extensive* testing and will
likely break existing installations. 8-(
Reply to: