summaryrefslogtreecommitdiffstats
path: root/krebs/5pkgs/Reaktor/scripts
diff options
context:
space:
mode:
authortv <tv@krebsco.de>2016-11-18 14:44:18 +0100
committertv <tv@krebsco.de>2016-11-18 14:44:18 +0100
commit151ca19a6e67e0c7644f489069cfbc17cec71187 (patch)
treef84467f88558afb721ca716cc582e6d0b9abadf3 /krebs/5pkgs/Reaktor/scripts
parent0f523dfd8a560aa5f5e36c90d47e2322f3dd7882 (diff)
parent0155fc32e1b79bc25fdfc81ee8460438b70ba128 (diff)
Merge remote-tracking branch 'gum/master'
Diffstat (limited to 'krebs/5pkgs/Reaktor/scripts')
-rw-r--r--krebs/5pkgs/Reaktor/scripts/sed-plugin.py17
1 files changed, 15 insertions, 2 deletions
diff --git a/krebs/5pkgs/Reaktor/scripts/sed-plugin.py b/krebs/5pkgs/Reaktor/scripts/sed-plugin.py
index 8103c9585..6039aeb43 100644
--- a/krebs/5pkgs/Reaktor/scripts/sed-plugin.py
+++ b/krebs/5pkgs/Reaktor/scripts/sed-plugin.py
@@ -34,9 +34,22 @@ if m:
flagstr = ''
last = d.get(usr,None)
if last:
- #print(re.sub(fn,tn,last,count=count,flags=flags))
from subprocess import Popen,PIPE
- p = Popen(['sed','s/{}/{}/{}'.format(f,t,flagstr)],stdin=PIPE,stdout=PIPE )
+ import shutil
+ from os.path import realpath
+ # sed only needs stdin/stdout, we protect state_dir with this
+ # input to read/write arbitrary files:
+ # s/.\/\/; w /tmp/i (props to waldi)
+ # conclusion: sed is untrusted and we handle it like this
+ p = Popen(['proot',
+ # '-v','1',
+ '-w','/', # cwd is root
+ '-b','/nix/store', # mount important folders
+ '-b','/usr',
+ '-b','/bin',
+ '-r','/var/empty', # chroot to /var/empty
+ realpath(shutil.which('sed')),
+ 's/{}/{}/{}'.format(f,t,flagstr)],stdin=PIPE,stdout=PIPE )
so,se = p.communicate(bytes("{}\n".format(last),"UTF-8"))
if p.returncode:
print("something went wrong when trying to process your regex: {}".format(se.decode()))