[gopher] Re: Bucktooth questions

[brian@xxxxxxxxxxxxx]

On Sat, Jun 30, 2007 at 07:09:35AM -0700, Cameron Kaiser wrote:
> > Well, finally got around to setting up Bucktooth.  Right now I'm
> > testing on an iBook, but will end up running everything on a Linux
> > box.  I'm running under xinetd as user "www".  I had to make the
> > following mods to buckd to get things to work under setgid:

Cameron--

It's not your code (but forcing it to run under taint mode might be a
good idea).  It's just Perl saying "Hey, in case you didn't realize
it, I'm running this in taint mode, even though you didn't specify -T,
and you'll have to live with it."  Living with "it" means doing things
like untaininting $ENV{PATH} (even if it's not used -- a requirement
when calling exec(), because an exec'd() process would have access to
whatever is in $ENV{PATH}).

Let's see...perl version is 5.8.1.  

Here are a couple of error messages:

* No -s allowed while running setgid.
* Insecure dependency in exec while running setgid at /usr/local/bin/buckd line 
2 79, <STDIN> line 1.
* Insecure $ENV{PATH} while running setgid at /usr/local/bin/buckd line 277, 
<STD IN> line 1.

Here were the changes to get things working:

--- buckd.orig  Sat Jun 30 09:27:18 2007
+++ buckd   Sat Jun 30 09:25:27 2007
@@ -1,4 +1,4 @@
-#!/usr/bin/perl -s
+#!/usr/bin/perl
    
 #####################################################################
 # Bucktooth 0.2.1 (c)1999, 2001-2006 Cameron Kaiser                 #
@@ -65,6 +65,18 @@
        exit;
    }
    ($request, $dinfo) = split(/\?/, $orq, 2);
+   if ($dinfo =~ /^([ -\@\w.]+)$/) {
+       $dinfo = $1; 
+   } elsif($dinfo) { 
+       &log("Bad data in \$dinfo: '$dinfo'");
+       exit;
+   }
+   if ($request =~ /^([\/-\@\w.]+)$/) {
+       $request = $1; 
+   } elsif($request) {
+       &log("Bad data in \$request: '$request'");
+       exit;
+   }
    
    $request =~ s/%([a-fA-F0-9]{2})/pack("H2", $1)/eg;
    # $request must be absolute ...
@@ -258,6 +270,7 @@
    $ENV{'SERVER_PORT'} = $MYPORT;
    $ENV{'SELECTOR'} = $orq;
    $ENV{'GPLUS'} = $gplus;
+   $ENV{'PATH'} =  $DIR;
    &fixgplus;
    &log("\"$orq\" ${gplus}[200 \"$locator\" \"$dinfo\" executed]");
    $ENV{'REQUEST'} = $request;