summaryrefslogtreecommitdiff
path: root/util
diff options
context:
space:
mode:
authorMartin Roth <martinroth@google.com>2017-08-30 13:53:58 -0600
committerMartin Roth <martinroth@google.com>2017-09-02 15:17:58 +0000
commit1f3daeab41826028e8f78afd64a32aab986b406b (patch)
tree33cae97b0d7eb1bedbcb2b74980e74419bb86f32 /util
parentaaebb415d77c49a21b8c7c35aa5b2937debeadb0 (diff)
downloadcoreboot-1f3daeab41826028e8f78afd64a32aab986b406b.tar.xz
util/lint/checkpatch: Untaint variables from env & command line
Jenkins is giving warnings due tainted variables from the environment and command line: Insecure $ENV{PATH} while running setgid at util/lint/checkpatch.pl line 907, <$conststructs> line 39. Insecure dependency in piped open while running setgid at util/lint/checkpatch.pl line 907, <$conststructs> line 39. This should fix those warnings. Change-Id: I6a09915d13547bf9a86c011d44cbcd39c46f3fec Signed-off-by: Martin Roth <martinroth@google.com> Reviewed-on: https://review.coreboot.org/21293 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Patrick Georgi <pgeorgi@google.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Diffstat (limited to 'util')
-rwxr-xr-xutil/lint/checkpatch.pl10
1 files changed, 9 insertions, 1 deletions
diff --git a/util/lint/checkpatch.pl b/util/lint/checkpatch.pl
index 75f6f981de..adcb0fa93a 100755
--- a/util/lint/checkpatch.pl
+++ b/util/lint/checkpatch.pl
@@ -59,6 +59,13 @@ my $conststructsfile = "$D/const_structs.checkpatch";
my $color = 1;
my $allow_c99_comments = 1;
+# For coreboot jenkins
+# If taint mode is enabled, Untaint the path - files must be in /bin, /usr/bin or /usr/local/bin
+if ( ${^TAINT} ) {
+ $ENV{'PATH'} = '/bin:/usr/bin:/usr/local/bin';
+ delete @ENV{ 'IFS', 'CDPATH', 'ENV', 'BASH_ENV' };
+}
+
sub help {
my ($exitcode) = @_;
@@ -898,8 +905,9 @@ if ($git) {
}
my $vname;
-for my $filename (@ARGV) {
+for my $f (@ARGV) {
my $FILE;
+ my ($filename) = ($f =~ /^(.*)$/);
if ($git) {
open($FILE, '-|', "git format-patch -M --stdout -1 $filename") ||
die "$P: $filename: git format-patch failed - $!\n";