HexBrain

Ruby · Report #449617

Null character at fnmatch

Validstatus
3upvotes
16 Oct 2019disclosed

How it was found

I confirmed that it will behave unintentionally when null characters are entered in patterns with fnmatch,fnmatch?.

$ ruby -v
ruby 2.5.3p105 (2018-10-18 revision 65156) [x86_64-darwin16]

$ irb
irb(main):001:0> require 'pathname'
=> true

# should not be true
irb(main):002:0> File.fnmatch("x\0yz", 'x')
=> true
irb(main):003:0> File.fnmatch?("abc\0", 'abc')
=> true
irb(main):004:0> Pathname('x').fnmatch("x\0yz")
=> true
irb(main):005:0> Pathname('abc').fnmatch?("abc\0")
=> true

# It does not work as a delimiter
irb(main):006:0> File.fnmatch("x\0yz", 'yz')
=> false
irb(main):007:0> Pathname('yz').fnmatch("x\0yz")
=> false

# error
irb(main):008:0> File.fnmatch('x', "x\0")
Traceback (most recent call last):
        3: from /usr/local/bin/irb:11:in `<main>'
        2: from (irb):8
        1: from (irb):8:in `fnmatch'
ArgumentError (path name contains null byte)
irb(main):009:0> Pathname("x\0").fnmatch('x')
Traceback (most recent call last):
        4: from /usr/local/bin/irb:11:in `<main>'
        3: from (irb):9
        2: from (irb):9:in `Pathname'
        1: from (irb):9:in `initialize'
ArgumentError (pathname contains null byte)

Impact

When using these methods, unintended file operation may be performed.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original