Skip to content

Commit 5b14a12

Browse files
committed
Ensure port is a string in psql command
In 841187b a shell execution vulnerability was fixed by passing an array. In my environment (Debian 10, Ruby 2.5, Puppet 5) it was failing because port was an Integer and command execution only allows Strings. This explicitly converts the port to a string. Fixes: 841187b
1 parent e582cb0 commit 5b14a12

File tree

1 file changed

+1
-1
lines changed
  • lib/puppet/provider/postgresql_psql

1 file changed

+1
-1
lines changed

lib/puppet/provider/postgresql_psql/ruby.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ def run_sql_command(sql)
1515

1616
command = [resource[:psql_path]]
1717
command.push('-d', resource[:db]) if resource[:db]
18-
command.push('-p', resource[:port]) if resource[:port]
18+
command.push('-p', resource[:port].to_s) if resource[:port]
1919
command.push('-t', '-X', '-c', sql)
2020

2121
environment = fetch_environment

0 commit comments

Comments
 (0)