From 3cd8ce3bce1e3d89b21caa0d3ad458193f5179ba Mon Sep 17 00:00:00 2001 From: Anders Kaseorg Date: Wed, 1 Jan 2020 16:29:34 -0800 Subject: treewide: Fix unsafe concatenation of $LD_LIBRARY_PATH Naive concatenation of $LD_LIBRARY_PATH can result in an empty colon-delimited segment; this tells glibc to load libraries from the current directory, which is definitely wrong, and may be a security vulnerability if the current directory is untrusted. (See #67234, for example.) Fix this throughout the tree. Signed-off-by: Anders Kaseorg --- pkgs/applications/office/gnucash/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'pkgs/applications/office') diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix index 963a896dd51..476b1128b94 100644 --- a/pkgs/applications/office/gnucash/default.nix +++ b/pkgs/applications/office/gnucash/default.nix @@ -79,7 +79,7 @@ stdenv.mkDerivation rec { # 80 - test-gnc-module-scm-module (Failed) # 81 - test-gnc-module-scm-multi (Failed) preCheck = '' - export LD_LIBRARY_PATH=$PWD/lib:$PWD/lib/gnucash:$PWD/lib/gnucash/test:$LD_LIBRARY_PATH + export LD_LIBRARY_PATH=$PWD/lib:$PWD/lib/gnucash:$PWD/lib/gnucash/test''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH export NIX_CFLAGS_LINK="-lgtest -lgtest_main" ''; doCheck = false; -- cgit 1.4.1