tree 8daf03b39ec9698fef3a0013590b394d7003ff99
parent 3f2d646132b55b152cff4ba7090cbeebdd48d477
author Jonas Termansen <sortie@google.com> 1560259282 +0000
committer Jonas Termansen <sortie@google.com> 1560259745 +0200

[security] [dart:io] Fix current directory being in front of PATH.

This is a security improvement.

On Linux and Android, starting a process with Process.run, Process.runSync
or Process.start would first search the current directory before searching
PATH (Issue [37101][]). Operating systems other than Linux and Android
didn't have this behavior and aren't affected by this vulnerability.

Effectively this puts the current working directory in the front of PATH,
even if it wasn't in the PATH.

This change fixes that vulnerability and only searches the directories in
the PATH environment variable.

Fixes https://github.com/dart-lang/sdk/issues/37101

Change-Id: I05f3137753237f9b3ba4be4eba63ad07a75d865e
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/105582
Reviewed-by: William Hesse <whesse@google.com>