From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from ptx.hi.pengutronix.de ([2001:67c:670:100:1d::c0]) by metis.ext.pengutronix.de with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1eYWAj-0003Y0-Mp for ptxdist@pengutronix.de; Mon, 08 Jan 2018 13:04:57 +0100 Received: from mol by ptx.hi.pengutronix.de with local (Exim 4.89) (envelope-from ) id 1eYWAj-0002NF-EY for ptxdist@pengutronix.de; Mon, 08 Jan 2018 13:04:57 +0100 Date: Mon, 8 Jan 2018 13:04:57 +0100 From: Michael Olbrich Message-ID: <20180108120457.hj4ddbtfo5atjj7d@pengutronix.de> References: <20180105173719.3005-1-bst@pengutronix.de> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20180105173719.3005-1-bst@pengutronix.de> Subject: Re: [ptxdist] [PATCH 1/2] python2: prevent host path leakage List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: ptxdist-bounces@pengutronix.de Sender: "ptxdist" To: ptxdist@pengutronix.de T24gRnJpLCBKYW4gMDUsIDIwMTggYXQgMDY6Mzc6MThQTSArMDEwMCwgQmFzdGlhbiBTdGVuZGVy IHdyb3RlOgo+IElmIGhvc3QgYW5kIHRhcmdldCBhcmNoaXRlY3R1cmUgbWF0Y2ggUHlCdWlsZEV4 dC5jb21waWxlci5saWJyYXJ5X2RpcnMKPiBhbmQgUHlCdWlsZEV4dC5jb21waWxlci5pbmNsdWRl X2RpcnMgY29udGFpbiBob3N0IHBhdGhzIChlLmcuCj4gL3Vzci9saWIvaTM4Ni1saW51eC1nbnUs IC91c3IvaW5jbHVkZS9pMzg2LWxpbnV4LWdudSkgbGVhZGluZyB0byBidWlsZAo+IGZhaWx1cmVz IGZvciBzb21lIGV4dGVuc2lvbnMgKGF0IGxlYXN0IF9zc2wgYW5kIF9zb2NrZXQpLgo+IAo+IFNp Z25lZC1vZmYtYnk6IEJhc3RpYW4gU3RlbmRlciA8YnN0QHBlbmd1dHJvbml4LmRlPgo+IC0tLQo+ ICAuLi4vMDAwOS1weXRob24yLXByZXZlbnQtaG9zdC1wYXRoLWxlYWthZ2UucGF0Y2ggICB8IDM5 ICsrKysrKysrKysrKysrKysrKysrKysKPiAgcGF0Y2hlcy9QeXRob24tMi43LjEzL3NlcmllcyAg ICAgICAgICAgICAgICAgICAgICAgfCAgMyArLQo+ICAyIGZpbGVzIGNoYW5nZWQsIDQxIGluc2Vy dGlvbnMoKyksIDEgZGVsZXRpb24oLSkKPiAgY3JlYXRlIG1vZGUgMTAwNjQ0IHBhdGNoZXMvUHl0 aG9uLTIuNy4xMy8wMDA5LXB5dGhvbjItcHJldmVudC1ob3N0LXBhdGgtbGVha2FnZS5wYXRjaAo+ IAo+IGRpZmYgLS1naXQgYS9wYXRjaGVzL1B5dGhvbi0yLjcuMTMvMDAwOS1weXRob24yLXByZXZl bnQtaG9zdC1wYXRoLWxlYWthZ2UucGF0Y2ggYi9wYXRjaGVzL1B5dGhvbi0yLjcuMTMvMDAwOS1w eXRob24yLXByZXZlbnQtaG9zdC1wYXRoLWxlYWthZ2UucGF0Y2gKPiBuZXcgZmlsZSBtb2RlIDEw MDY0NAo+IGluZGV4IDAwMDAwMDAwMC4uN2Y0OWRhZDA2Cj4gLS0tIC9kZXYvbnVsbAo+ICsrKyBi L3BhdGNoZXMvUHl0aG9uLTIuNy4xMy8wMDA5LXB5dGhvbjItcHJldmVudC1ob3N0LXBhdGgtbGVh a2FnZS5wYXRjaAo+IEBAIC0wLDAgKzEsMzkgQEAKPiArRnJvbTogQmFzdGlhbiBTdGVuZGVyIDxi c3RAcGVuZ3V0cm9uaXguZGU+Cj4gK0RhdGU6IEZyaSwgNSBKYW4gMjAxOCAxODoyOTowNSArMDEw MAo+ICtTdWJqZWN0OiBbUEFUQ0hdIHB5dGhvbjI6IHByZXZlbnQgaG9zdCBwYXRoIGxlYWthZ2UK PiArCj4gK0lmIGhvc3QgYW5kIHRhcmdldCBhcmNoaXRlY3R1cmUgbWF0Y2ggUHlCdWlsZEV4dC5j b21waWxlci5saWJyYXJ5X2RpcnMKPiArYW5kIFB5QnVpbGRFeHQuY29tcGlsZXIuaW5jbHVkZV9k aXJzIGNvbnRhaW4gaG9zdCBwYXRocyAoZS5nLgo+ICsvdXNyL2xpYi9pMzg2LWxpbnV4LWdudSwg L3Vzci9pbmNsdWRlL2kzODYtbGludXgtZ251KSBsZWFkaW5nIHRvIGJ1aWxkCj4gK2ZhaWx1cmVz IGZvciBzb21lIGV4dGVuc2lvbnMgKGF0IGxlYXN0IF9zc2wgYW5kIF9zb2NrZXQpLgo+ICsKPiAr QmFzZWQgb24gYSBwYXRjaCBieSBBbGV4YW5kcnUgQXJkZWxlYW4gPGFyZGVsZWFuYWxleEBnbWFp bC5jb20+Lgo+ICsKPiArU2VlIGh0dHBzOi8vZ2l0aHViLmNvbS9vcGVud3J0L3BhY2thZ2VzL3B1 bGwvNzg0IGZvciByZWZlcmVuY2UuCj4gKwo+ICtTaWduZWQtb2ZmLWJ5OiBCYXN0aWFuIFN0ZW5k ZXIgPGJzdEBwZW5ndXRyb25peC5kZT4KPiArLS0tCj4gKyBzZXR1cC5weSB8IDggKysrKy0tLS0K PiArIDEgZmlsZSBjaGFuZ2VkLCA0IGluc2VydGlvbnMoKyksIDQgZGVsZXRpb25zKC0pCj4gKwo+ ICtkaWZmIC0tZ2l0IGEvc2V0dXAucHkgYi9zZXR1cC5weQo+ICtpbmRleCA4ODczODMxMzIzZjAu LmFiNTBjY2ZjMDNjZSAxMDA2NDQKPiArLS0tIGEvc2V0dXAucHkKPiArKysrIGIvc2V0dXAucHkK PiArQEAgLTQ1NSwxMiArNDU1LDEyIEBAIGNsYXNzIFB5QnVpbGRFeHQoYnVpbGRfZXh0KToKPiAr IAo+ICsgICAgIGRlZiBkZXRlY3RfbW9kdWxlcyhzZWxmKToKPiArICAgICAgICAgIyBFbnN1cmUg dGhhdCAvdXNyL2xvY2FsIGlzIGFsd2F5cyB1c2VkCj4gKy0gICAgICAgIGlmIG5vdCBjcm9zc19j b21waWxpbmc6Cj4gKy0gICAgICAgICAgICBhZGRfZGlyX3RvX2xpc3Qoc2VsZi5jb21waWxlci5s aWJyYXJ5X2RpcnMsICcvdXNyL2xvY2FsL2xpYicpCj4gKy0gICAgICAgICAgICBhZGRfZGlyX3Rv X2xpc3Qoc2VsZi5jb21waWxlci5pbmNsdWRlX2RpcnMsICcvdXNyL2xvY2FsL2luY2x1ZGUnKQo+ ICsrICAgICAgICAjaWYgbm90IGNyb3NzX2NvbXBpbGluZzoKPiArKyAgICAgICAgIyAgICBhZGRf ZGlyX3RvX2xpc3Qoc2VsZi5jb21waWxlci5saWJyYXJ5X2RpcnMsICcvdXNyL2xvY2FsL2xpYicp Cj4gKysgICAgICAgICMgICAgYWRkX2Rpcl90b19saXN0KHNlbGYuY29tcGlsZXIuaW5jbHVkZV9k aXJzLCAnL3Vzci9sb2NhbC9pbmNsdWRlJykKCldoeSBpcyB0aGlzIG5lY2Vzc2FyeT8KCj4gKyAg ICAgICAgIGlmIGNyb3NzX2NvbXBpbGluZzoKPiArICAgICAgICAgICAgIHNlbGYuYWRkX2djY19w YXRocygpCj4gKy0gICAgICAgIHNlbGYuYWRkX211bHRpYXJjaF9wYXRocygpCj4gKysgICAgICAg ICNzZWxmLmFkZF9tdWx0aWFyY2hfcGF0aHMoKQoKVGhpcyBzaG91bGQgZGVwZW5kIG9uICdub3Qg Y3Jvc3NfY29tcGlsaW5nJyBpbnN0ZWFkLiBPdGhlcndpc2UsIHRoZXJlIG1heQpiZSBwcm9ibGVt cyBidWlsZGluZyBob3N0LXB5dGhvbi4KCk1pY2hhZWwKCj4gKyAKPiArICAgICAgICAgIyBBZGQg cGF0aHMgc3BlY2lmaWVkIGluIHRoZSBlbnZpcm9ubWVudCB2YXJpYWJsZXMgTERGTEFHUyBhbmQK PiArICAgICAgICAgIyBDUFBGTEFHUyBmb3IgaGVhZGVyIGFuZCBsaWJyYXJ5IGZpbGVzLgo+IGRp ZmYgLS1naXQgYS9wYXRjaGVzL1B5dGhvbi0yLjcuMTMvc2VyaWVzIGIvcGF0Y2hlcy9QeXRob24t Mi43LjEzL3Nlcmllcwo+IGluZGV4IDNhODI2NTg4OC4uNDc2MjQ0NzM0IDEwMDY0NAo+IC0tLSBh L3BhdGNoZXMvUHl0aG9uLTIuNy4xMy9zZXJpZXMKPiArKysgYi9wYXRjaGVzL1B5dGhvbi0yLjcu MTMvc2VyaWVzCj4gQEAgLTgsNCArOCw1IEBACj4gIDAwMDYtcHl0aG9uLWRvbi10LWFkZC1ycGF0 aHMtaW4tc2V0dXAucHkucGF0Y2gKPiAgMDAwNy1hZGQtbW9yZS1zZWFyY2gtcGF0aHMucGF0Y2gK PiAgMDAwOC1yZXNvbHZlLWV4aXN0aW5nLUxEX0xJQlJBUllfUEFUSC1kdXJpbmctbWFrZS1ub3Qt ZHVyLnBhdGNoCj4gLSMgOTQ5N2I1NzQyMTJjYzg3MGU0YzhmY2U0ZGQxYjBiNDQgIC0gZ2l0LXB0 eC1wYXRjaGVzIG1hZ2ljCj4gKzAwMDktcHl0aG9uMi1wcmV2ZW50LWhvc3QtcGF0aC1sZWFrYWdl LnBhdGNoCj4gKyMgMWZiNDhiMjg0OGMxMDJlMzg0ODk5OWIxZDlmNjU3MTAgIC0gZ2l0LXB0eC1w YXRjaGVzIG1hZ2ljCj4gLS0gCj4gMi4xMS4wCj4gCj4gCj4gX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX18KPiBwdHhkaXN0IG1haWxpbmcgbGlzdAo+IHB0eGRp c3RAcGVuZ3V0cm9uaXguZGUKCi0tIApQZW5ndXRyb25peCBlLksuICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfApJbmR1c3RyaWFsIExpbnV4 IFNvbHV0aW9ucyAgICAgICAgICAgICAgICAgfCBodHRwOi8vd3d3LnBlbmd1dHJvbml4LmRlLyAg fApQZWluZXIgU3RyLiA2LTgsIDMxMTM3IEhpbGRlc2hlaW0sIEdlcm1hbnkgfCBQaG9uZTogKzQ5 LTUxMjEtMjA2OTE3LTAgICAgfApBbXRzZ2VyaWNodCBIaWxkZXNoZWltLCBIUkEgMjY4NiAgICAg ICAgICAgfCBGYXg6ICAgKzQ5LTUxMjEtMjA2OTE3LTU1NTUgfAoKX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18KcHR4ZGlzdCBtYWlsaW5nIGxpc3QKcHR4ZGlz dEBwZW5ndXRyb25peC5kZQ==