1. Jon Avatar Jon
  2. Untitled project
  3. uru
  4. Issues

git-bash (MSYS2) failures with absolute PATH canaries

Issue #92 closed
Jon repo owner created an issue

Testing initial fix for bug #90 gives the following usage failures when running under MSYS2-based git-bash:

Jon@BLACK MINGW64 ~/Documents
$ git version
git version 2.10.1.windows.1

Jon@BLACK MINGW64 ~/Documents
$ uname -a
MINGW64_NT-6.3 BLACK 2.6.0(0.304/5/3) 2016-09-09 09:46 x86_64 Msys

Jon@BLACK MINGW64 ~/Documents
$ uru ver
uru v0.8.3.b1 [windows/386 go1.7.1]

Jon@BLACK MINGW64 ~/Documents
$ uru ls
    226p380-x32 : ruby 2.2.6p380 (2016-10-07 revision 56370) [i386-mingw32]
    232p200-x32 : ruby 2.3.2p200 (2016-10-18 revision 56441) [i386-mingw32]
    jruby       : jruby 9.1.5.0 (2.3.1) 2016-09-07 036ce39 Java HotSpot(TM) 64-Bit...

Jon@BLACK MINGW64 ~/Documents
$ uru 232 --debug-uru
2016/10/19 11:17:17 [DEBUG] initializing uru v0.8.3.b1
2016/10/19 11:17:17 [DEBUG] uru HOME is C:\Users\Jon\.uru
2016/10/19 11:17:17 [DEBUG] === ctx.Registry.Rubies ===
env.RubyMap{"1568909247":env.Ruby{ID:"2.3.2-p200", TagLabel:"232p200-x32", Exe:"ruby", Home:"C:\\Apps\\rubies\\ruby-2.3\\bin", GemHome:"", Description:"ruby 2.3.2p200 (2016-10-18 revision 56441) [i386-mingw32]"}, "158047625":env.Ruby{ID:"9.1.5", TagLabel:"jruby", Exe:"jruby", Home:"C:\\Apps\\rubies\\jruby\\bin", GemHome:"", Description:"jruby 9.1.5.0 (2.3.1) 2016-09-07 036ce39 Java HotSpot(TM) 64-Bit Server VM 25.102-b14 on 1.8.0_102-b14 +jit [mswin32-x86_64]"}, "430069599":env.Ruby{ID:"2.2.6-p380", TagLabel:"226p380-x32", Exe:"ruby", Home:"C:\\Apps\\rubies\\ruby-2.2\\bin", GemHome:"", Description:"ruby 2.2.6p380 (2016-10-07 revision 56370) [i386-mingw32]"}}
2016/10/19 11:17:17 [DEBUG] cmd = 232, args = []string(nil)
2016/10/19 11:17:17 [DEBUG] tags matching `232`
env.RubyMap{"1568909247":env.Ruby{ID:"2.3.2-p200", TagLabel:"232p200-x32", Exe:"ruby", Home:"C:\\Apps\\rubies\\ruby-2.3\\bin", GemHome:"", Description:"ruby 2.3.2p200 (2016-10-18 revision 56441) [i386-mingw32]"}}
2016/10/19 11:17:17 [DEBUG] === 232p200-x32 path list ===
  []string{"/_U1_", "C:\\Apps\\rubies\\ruby-2.3\\bin", "/_U2_", "C:\\Users\\Jon\\bin", "C:\\Apps\\git\\mingw64\\bin", "C:\\Apps\\git\\usr\\local\\bin", "C:\\Apps\\git\\usr\\bin", "C:\\Apps\\git\\usr\\bin", "C:\\Apps\\git\\mingw64\\bin", "C:\\Apps\\git\\usr\\bin", "C:\\Users\\Jon\\bin", "C:\\Windows\\system32", "C:\\Windows", "C:\\Windows\\System32\\Wbem", "C:\\Windows\\System32\\WindowsPowerShell\\v1.0", "C:\\ProgramData\\chocolatey\\bin", "C:\\tools", "C:\\Apps\\git\\cmd", "C:\\Apps\\Mercurial", "C:\\Program Files\\Java\\jdk1.8.0_102\\bin", "C:\\Apps\\git\\usr\\bin\\vendor_perl", "C:\\Apps\\git\\usr\\bin\\core_perl"}
2016/10/19 11:17:17 [DEBUG] switcher script: uru_lackee
---> now using ruby 2.3.2-p200 tagged as `232p200-x32`

Jon@BLACK MINGW64 ~/Documents
$ echo $PATH
/_U1_:/C/Apps/rubies/ruby-2.3/bin:/_U2_:/C/Users/Jon/bin:/C/Apps/git/mingw64/bin:/C/Apps/git/usr/local/bin:/C/Apps/git/usr/bin:/C/Apps/git/usr/bin:/C/Apps/git/mingw64/bin:/C/Apps/git/usr/bin:/C/Users/Jon/bin:/C/Windows/system32:/C/Windows:/C/Windows/System32/Wbem:/C/Windows/System32/WindowsPowerShell/v1.0:/C/ProgramData/chocolatey/bin:/C/tools:/C/Apps/git/cmd:/C/Apps/Mercurial:/C/Program Files/Java/jdk1.8.0_102/bin:/C/Apps/git/usr/bin/vendor_perl:/C/Apps/git/usr/bin/core_perl

### FAIL - indicator for activated ruby missing
Jon@BLACK MINGW64 ~/Documents
$ uru ls
    226p380-x32 : ruby 2.2.6p380 (2016-10-07 revision 56370) [i386-mingw32]
    232p200-x32 : ruby 2.3.2p200 (2016-10-18 revision 56441) [i386-mingw32]
    jruby       : jruby 9.1.5.0 (2.3.1) 2016-09-07 036ce39 Java HotSpot(TM) 64-Bit...

Jon@BLACK MINGW64 ~/Documents
$ uru nil --debug-uru
2016/10/19 11:18:07 [DEBUG] initializing uru v0.8.3.b1
2016/10/19 11:18:07 [DEBUG] uru HOME is C:\Users\Jon\.uru
2016/10/19 11:18:07 [DEBUG] === ctx.Registry.Rubies ===
env.RubyMap{"1568909247":env.Ruby{ID:"2.3.2-p200", TagLabel:"232p200-x32", Exe:"ruby", Home:"C:\\Apps\\rubies\\ruby-2.3\\bin", GemHome:"", Description:"ruby 2.3.2p200 (2016-10-18 revision 56441) [i386-mingw32]"}, "158047625":env.Ruby{ID:"9.1.5", TagLabel:"jruby", Exe:"jruby", Home:"C:\\Apps\\rubies\\jruby\\bin", GemHome:"", Description:"jruby 9.1.5.0 (2.3.1) 2016-09-07 036ce39 Java HotSpot(TM) 64-Bit Server VM 25.102-b14 on 1.8.0_102-b14 +jit [mswin32-x86_64]"}, "430069599":env.Ruby{ID:"2.2.6-p380", TagLabel:"226p380-x32", Exe:"ruby", Home:"C:\\Apps\\rubies\\ruby-2.2\\bin", GemHome:"", Description:"ruby 2.2.6p380 (2016-10-07 revision 56370) [i386-mingw32]"}}
2016/10/19 11:18:07 [DEBUG] cmd = nil, args = []string(nil)

### FAIL - ruby should be removed from PATH
Jon@BLACK MINGW64 ~/Documents
$ echo $PATH
/_U1_:/C/Apps/rubies/ruby-2.3/bin:/_U2_:/C/Users/Jon/bin:/C/Apps/git/mingw64/bin:/C/Apps/git/usr/local/bin:/C/Apps/git/usr/bin:/C/Apps/git/usr/bin:/C/Apps/git/mingw64/bin:/C/Apps/git/usr/bin:/C/Users/Jon/bin:/C/Windows/system32:/C/Windows:/C/Windows/System32/Wbem:/C/Windows/System32/WindowsPowerShell/v1.0:/C/ProgramData/chocolatey/bin:/C/tools:/C/Apps/git/cmd:/C/Apps/Mercurial:/C/Program Files/Java/jdk1.8.0_102/bin:/C/Apps/git/usr/bin/vendor_perl:/C/Apps/git/usr/bin/core_perl

Comments (3)

  1. Jon reporter

    Using absolute PATH canaries such as /_U1_ is incompatible with MSYS2's dynamic munging of absolute paths.

    For example, while in a git-bash shell, PATH is manipulated so that / refers to an install location. Outside applications (pypy in this example) return a different PATH.

    Jon@BLACK MINGW64 ~/Documents
$ PATH=/_U1_:$PATH

Jon@BLACK MINGW64 ~/Documents
$ echo $PATH
/_U1_:/c/Users/Jon/bin:/mingw64/bin:/usr/local/bin:/usr/bin:/bin:/mingw64/bin:/usr/bin:/c/Users/Jon/bin:...

Jon@BLACK MINGW64 ~/Documents
$ cygpath -w /
C:\Apps\git

Jon@BLACK MINGW64 ~/Documents
$ cygpath -w /_U_
C:\Apps\git\_U_

Jon@BLACK MINGW64 ~/Documents
$ /c/Apps/pypy/pypy -c "import os; print os.environ['PATH']"
C:\Apps\git\_U1_;C:\Users\Jon\bin;C:\Apps\git\mingw64\bin;C:\Apps\git\usr\local\bin;C:\Apps\git\usr\bin;C:\Apps\git\usr\bin;C:\Apps\git\mingw64\bin;C:\Apps\git\usr\bin;C:\Users\Jon\bin;...
  2. Jon reporter

    Single PATH canaries of ::: and ;;; originally caused problems for msys2-based environments.

    Unless I can find a workaround or another solution, the decision will be between using more secure absolute PATH canaries and losing git-bash, or using the current less secure relative PATH canaries.

  3. Jon reporter

    Fix weakness with PATH canaries. Closes #90, #92

    Uru's use of relative PATH canaries _U1_ and _U2_ to sandbox PATH to enable easy activation and deactivation of registered rubies was a security weakness. This commit minimizes that weakness by using absolute PATH canaries /_U1_ and /_U2_ in Windows, Linux, and OSX environments. In MSYS2-based systems on Windows such as git-bash, U:\_U1_ and U:\_U2_ are used.

    → <<cset cf4751fec569>>

  4. Log in to comment
Assignee
Type
bug
Priority
major
Status
closed
Votes
0
Watchers
1
Jira: the preferred issue tracker for Bitbucket. Join the team!