[Monotone-devel] security issue

[graydon hoare]

hi,

last night I posted a change which addresses a security hole in 
monotone: several lua hooks were running os.execute() which in turn ran 
system() on a string. since this string included user data (file_paths), 
and file_path syntax has relaxed significantly to permit whitespace and 
semicolons, it was possible to encode shell commands in file_paths and 
have hooks execute them. if you happened to do an update or merge from a 
"trusted" source (which is weakly defined under the default rules) you 
might have been vulnerable to this form of attack.

I've replaced instances of os.execute() with calls to fork, execvp, and 
wait, and removed the system() and popen() paths from the lua library. 
if you're using monotone in a setting with not-really-well-trusted 
contributors, you might want to upgrade to a development head after 
4899e5fe2e92124ac6ba4223aa4b80305e2a5aa8.

(I don't really know what the protocol is for this, or more serious 
security notices; presumably at some level of visibility and maturity 
it'll be the "right" thing to do to file a vulnerability report with 
various parties.. but is that sort of thing necessary while we're still 
an alpha project with rapidly changing code? I don't know. any advice?)

-graydon