[Slackbuilds-users] Add "unset CDPATH" at the head of SlackBuilds

Grissiom chaos.proton at gmail.com
Mon Jul 12 08:02:32 UTC 2010


In recent work, I know that it is better to unset CDPATH at the very
beginning of packaging scripts. There are tow reasons:

1, If CDPATH is not empty, cd will echo the dir name to stdout each
time changes pwd. This will mess up the output in some cases.

2, User can use CDPATH to mislead cd's search path and then _may_ do
something dangerous. For example:

~/test$ pwd
~/test$ cat t.sh
export CDPATH="$HOME/test"

cd $HOME
echo "I'm at" $PWD

cd test-cdpath
echo "I'm at" $PWD "now"
~/test$ file ./test-cdpath/
./test-cdpath/: directory
~/test$ file ~/test-cdpath/
/home/grissiom/test-cdpath/: directory
~/test$ sh t.sh
I'm at /home/grissiom
I'm at /home/grissiom/test/test-cdpath now

You can see CDPATH can make cd don't change into folder under current
directory. This may lead to vulnerable  problems in SlackBuilds.
This is tested in normal user but applicable to root.


More information about the SlackBuilds-users mailing list