Problem - Kevin Tafuro

variants we’re explicitly supporting in this book, Darwin is the major exception here
because it does not use ELF (Executable and Linking Format) for its executable format)
and most standard implementations of malloc( ) all recognize a wide variety of
environment variables that control their behavior.
In most cases, you should never be doing anything in your programs that will make
use of the PATH environment variable. Circumstances do exist in which it may be reasonable
to do so, but make sure to weigh your options carefully beforehand. Indeed,
you should consider carefully whether you should be using any environment variable
in your programs. Regardless, if you launch external programs from within your
program, you may not have control over what the external programs do, so you
should take care to provide any external programs you launch with a sane and secure
environment.
In particular, the two environment variables IFS and PATH should always be forced to
sane values. The IFS environment variable is somewhat obscure, but it is used by
many shells to determine which character separates command-line arguments. Modern
Unix shells use a reasonable default value for IFS if it is not already set. Nonetheless,
you should defensively assume that the shell does nothing of the sort. Therefore,
instead of simply deleting the IFS environment variable, set it to something sane,
such as a space, tab, and newline character.
The PATH environment variable is used by the shell and some of the exec*( ) family of
standard C functions to locate an executable if a path is not explicitly specified. The
search path should never include relative paths, especially the current directory as
denoted by a single period. To be safe, you should always force the setting of the
PATH environment variable to _PATH_STDPATH, which is defined in paths.h. This value is
what the shell normally uses to initialize the variable, but an attacker or naïve user
could change it later. The definition of _PATH_STDPATH differs from platform to platform,
so you should generally always use that value so that you get the right standard
paths for the system your program is running on.
Finally, the TZ environment variable denotes the time zone that the program should
use, when relevant. Because users may not be in the same time zone as the machine
(which will use a default whenever the variable is not set), it is a good idea to preserve
this variable, if present. Note also that this variable is generally used by the OS,
not the application. If you’re using it at the application level, make sure to do proper
input validation to protect against problems such as buffer overflow.
Finally, a special environment variable,, is defined to be the time zone on many systems.
All systems will use it if it is defined, but while most systems will get along fine
without it, some systems will not function properly without its being set. Therefore,
you should preserve it if it is present.
Any other environment variables that are defined should be removed unless you
know, for some reason, that you need the variable to be set. For any environment
4 | Chapter 1: Safe Initialization
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.