Re: Handling ‘file’ CVE

[Eric Bavier]

Mark H Weaver writes:

> Finally, 'file' is a propagated-input for 'intltool', which means that
> if anyone installs 'intltool' in their profile, they will have the buggy
> 'file' in their PATH.

The attached patch might be enough to fix this.

>From fff25ec0451a65ccd5972d16ef96221c85084566 Mon Sep 17 00:00:00 2001
From: Eric Bavier <address@hidden>
Date: Thu, 13 Nov 2014 12:46:04 -0600
Subject: [PATCH] gnu: intltool: Make file a regular input.

* gnu/packages/glib.scm (intltool)[propagated-inputs]: Move file from here...
  [inputs]: to here.
  [arguments]: New 'patch-file-references phase.
---
 gnu/packages/glib.scm |   11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/glib.scm b/gnu/packages/glib.scm
index 9076643..212d3b6 100644
--- a/gnu/packages/glib.scm
+++ b/gnu/packages/glib.scm
@@ -250,16 +250,21 @@ bindings to call into the C library.")
               (base32
                "01j4yd7i84n9nk4ccs6yifg84pp68nr9by57jdbhj7dpdxf5rwk7"))))
     (build-system gnu-build-system)
+    (inputs
+     `(("file" ,file)))
     (propagated-inputs
      `(;; Propagate gettext because users expect it to be there, and so does
        ;; the `intltool-update' script.
        ("gettext" ,gnu-gettext)
 
-       ;; `file' is used by `intltool-update' too.
-       ("file" ,file)
-
        ("perl-xml-parser" ,perl-xml-parser)
        ("perl" ,perl)))
+    (arguments
+     `(#:phases (alist-cons-after
+                 'unpack 'patch-file-references
+                 (lambda _
+                   (substitute* "intltool-update.in"
+                     (("`file") (string-append "`" (which "file"))))))))
     (home-page "https://launchpad.net/intltool/+download";)
     (synopsis "Tools to centralise translations of different file formats")
     (description
-- 
1.7.9.5

-- 
Eric Bavier

Please avoid sending me Word or PowerPoint attachments.
See http://www.gnu.org/philosophy/no-word-attachments.html