Skip to content

Commit 7f810b9

Browse files
committed
Ensure port is a string in psql command
In 841187b a shell execution vulnerability was fixed by passing an array. In my environment (Debian 10, Ruby 2.5, Puppet 5) it was failing because port was an Integer and command execution only allows Strings. This explicitly converts the port to a string. Fixes: 841187b
1 parent 10acc92 commit 7f810b9

File tree

1 file changed

+1
-1
lines changed
  • lib/puppet/provider/postgresql_psql

1 file changed

+1
-1
lines changed

lib/puppet/provider/postgresql_psql/ruby.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ def run_sql_command(sql)
1515

1616
command = [resource[:psql_path]]
1717
command.push('-d', resource[:db]) if resource[:db]
18-
command.push('-p', resource[:port]) if resource[:port]
18+
command.push('-p', resource[:port].to_s) if resource[:port]
1919
command.push('-t', '-X', '-c', sql)
2020

2121
environment = fetch_environment

0 commit comments

Comments
 (0)