Uploaded image for project: 'NetBeans'
  1. NetBeans
  2. NETBEANS-1727

Native Execution does not correctly sanitize username for temp directory

    XMLWordPrintableJSON

Details

    Description

      When running netbeans on linux this log entry can be observed:

      [exec] WARNING [nativeexecution.support.logger]: [743838 ms.] UnixHostInfoProvider: sed: -e Ausdruck #1, Zeichen 6: Nicht beendeter »s«-Befehl
      

      The english version is:

      sed: -e expression #1, char 6: unterminated `s' command
      

      The problem can be traced back into the release/bin/nativeexecution/hostinfo.sh script used by the Native Execution (ide/dlight.nativeexecution) module.

      In the file line 119 is the problem:

      USER_D=`echo ${USER} | sed "s/\\\/_/"`
      TMPBASE=${TMPBASE:-/var/tmp}
      
      SUFFIX=0
      TMPDIRBASE=${TMPBASE}/dlight_${USER_D}
      

      The backslashes in the sed call are not correctly escaped. From the context I assume, that the call is intended to replace directory separator with underscores.

      With a user value of "demo/user\test" I would expect it to result in "demo_user_test" as the call errors out, it results in the empty string. See this debug run:

      + USER='demo/user\test'
      ++ echo 'demo/user\test'
      ++ sed 's/\/_/'
      sed: -e expression #1, char 6: unterminated `s' command
      + USER_D=
      + TMPBASE=/var/tmp
      + SUFFIX=0
      + TMPDIRBASE=/var/tmp/dlight_
      

      With the fix I'll propose the above becomes:

      + USER='demo/user\test'
      ++ echo 'demo/user\test'
      ++ sed 's/[\/]/_/g'
      + USER_D=demo_user_test
      + TMPBASE=/var/tmp
      + SUFFIX=0
      + TMPDIRBASE=/var/tmp/dlight_demo_user_test
      

      Attachments

        Issue Links

          Activity

            People

              matthiasblaesing Matthias Bläsing
              matthiasblaesing Matthias Bläsing
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 20m
                  20m