From 3cd8ce3bce1e3d89b21caa0d3ad458193f5179ba Mon Sep 17 00:00:00 2001 From: Anders Kaseorg Date: Wed, 1 Jan 2020 16:29:34 -0800 Subject: treewide: Fix unsafe concatenation of $LD_LIBRARY_PATH Naive concatenation of $LD_LIBRARY_PATH can result in an empty colon-delimited segment; this tells glibc to load libraries from the current directory, which is definitely wrong, and may be a security vulnerability if the current directory is untrusted. (See #67234, for example.) Fix this throughout the tree. Signed-off-by: Anders Kaseorg --- pkgs/development/compilers/solc/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'pkgs/development/compilers/solc') diff --git a/pkgs/development/compilers/solc/default.nix b/pkgs/development/compilers/solc/default.nix index 23e6c64f3ffcb..0f71ed79e7ee3 100644 --- a/pkgs/development/compilers/solc/default.nix +++ b/pkgs/development/compilers/solc/default.nix @@ -49,7 +49,7 @@ stdenv.mkDerivation rec { checkPhase = '' while IFS= read -r -d ''' dir do - LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$(pwd)/$dir + LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$(pwd)/$dir export LD_LIBRARY_PATH done < <(find . -type d -print0) -- cgit 1.4.1