Sun 17 Jan 2010 06:40:19 AM UTC, original submission:
For some reason, a vile script I use quite a lot stopped working on my OS X system. I had to turn on $debug and tracing to figure out that an attempt to read a gzipped text file was failing with an warning that it was insecure (and the error was that the file was world-writable).
The file exists on a FAT volume mounted on my OS X system. Therefore, all files seem to have a mode 0777 (world writable).
The interesting thing was that the "file" I was editing was actually a pipe (remove the quotes): "!gzip -dc 195/19531.gz" (the file is a gzipped text file; archived mail file).
I thought that vile is supposed to consider data read from a pipe as read-only... but the complaint is that it's world writable... very weird!
The comment in bind.c seems to indicate that the check is for a file "sourced" on a Unix system; having it world or group writable can indeed be a security risk. However, this code is being checked during a pipe read.
To get around this problem, I simply commented out the check for world-writable and group-writable in bind.c.
I think this "security check" should be better thought out.
The script is simply allowing me to view an archived email message. Is this no longer allowed?
|