Merge pull request #3024 from martinhsv/v3/master

Add WRDE_NOCMD to wordexp call
owasp-modsecurity · Dec 6, 2023 · 3596994 · 3596994
2 parents 5b094c0 + 4c7a9bd
commit 3596994
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/CHANGES b/CHANGES
@@ -1,6 +1,8 @@
 v3.x.y - YYYY-MMM-DD (to be released)
 -------------------------------------
 
+  - Add WRDE_NOCMD to wordexp call
+    [Issue #3024 - @sahruldotid, @martinhsv]
   - Fix: validateDTD compile fails if when libxml2 not installed
     [Issue #3014 - @zangobot, @martinhsv]
   - Fix memory leak of validateDTD's dtd object

diff --git a/src/utils/system.cc b/src/utils/system.cc
@@ -1,6 +1,6 @@
 /*
  * ModSecurity, http://www.modsecurity.org/
- * Copyright (c) 2015 - 2021 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ * Copyright (c) 2015 - 2023 Trustwave Holdings, Inc. (http://www.trustwave.com/)
  *
  * You may not use this file except in compliance with
  * the License.  You may obtain a copy of the License at
@@ -130,6 +130,7 @@ std::list<std::string> expandEnv(const std::string& var, int flags) {
             for (char** exp = p.gl_pathv; *exp; ++exp) {
 #else
     wordexp_t p;
+    flags = flags | WRDE_NOCMD;
     if (wordexp(var.c_str(), &p, flags) == false) {
         if (p.we_wordc) {
             for (char** exp = p.we_wordv; *exp; ++exp) {