zimbatm/direnv — Issue #23: security considerations
Author: bemurphy
Created: 2012-01-01 03:45:53+00:00
State: open

I think there's a security bug around the evaluation of the .envrc file. I've run through this scenario and it seems to misbehave like I'd guessed.

If for instance in /tmp, Alice creates a .envrc file with `export PATH=/tmp:$PATH` and drops a malicious `ls` wrapper script there, when Bob executes `ls` in /tmp, he runs `/bin/ls` and is compromised.

I think rvm, for instance, deals with this by notifying the user of an untrusted .envrc encountered, along with hashes of file contents to prevent post-trust tampering.