Loading HuntDB...

Null character at fnmatch

R
Ruby
Submitted None
Reported by ooooooo_q

Vulnerability Details

Technical details and impact analysis

I confirmed that it will behave unintentionally when null characters are entered in patterns with `fnmatch`,` fnmatch? `. ```log $ ruby -v ruby 2.5.3p105 (2018-10-18 revision 65156) [x86_64-darwin16] $ irb irb(main):001:0> require 'pathname' => true # should not be true irb(main):002:0> File.fnmatch("x\0yz", 'x') => true irb(main):003:0> File.fnmatch?("abc\0", 'abc') => true irb(main):004:0> Pathname('x').fnmatch("x\0yz") => true irb(main):005:0> Pathname('abc').fnmatch?("abc\0") => true # It does not work as a delimiter irb(main):006:0> File.fnmatch("x\0yz", 'yz') => false irb(main):007:0> Pathname('yz').fnmatch("x\0yz") => false # error irb(main):008:0> File.fnmatch('x', "x\0") Traceback (most recent call last): 3: from /usr/local/bin/irb:11:in `<main>' 2: from (irb):8 1: from (irb):8:in `fnmatch' ArgumentError (path name contains null byte) irb(main):009:0> Pathname("x\0").fnmatch('x') Traceback (most recent call last): 4: from /usr/local/bin/irb:11:in `<main>' 3: from (irb):9 2: from (irb):9:in `Pathname' 1: from (irb):9:in `initialize' ArgumentError (pathname contains null byte) ``` ## Impact When using these methods, unintended file operation may be performed.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$200.00

Submitted