[security] [dart:io] Fix current directory being in front of PATH.

This is a security improvement.

On Linux and Android, starting a process with Process.run, Process.runSync
or Process.start would first search the current directory before searching
PATH (Issue [37101][]). Operating systems other than Linux and Android
didn't have this behavior and aren't affected by this vulnerability.

Effectively this puts the current working directory in the front of PATH,
even if it wasn't in the PATH.

This change fixes that vulnerability and only searches the directories in
the PATH environment variable.

Fixes https://github.com/dart-lang/sdk/issues/37101

Change-Id: I05f3137753237f9b3ba4be4eba63ad07a75d865e
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/105582
Reviewed-by: William Hesse <whesse@google.com>
3 files changed
tree: 8daf03b39ec9698fef3a0013590b394d7003ff99
  1. .clang-format
  2. .gitattributes
  3. .gitconfig
  4. .github/
  5. .gitignore
  6. .gn
  7. .mailmap
  8. .packages
  9. .vpython
  10. AUTHORS
  11. BUILD.gn
  12. CHANGELOG.md
  13. CONTRIBUTING.md
  14. DEPS
  15. LICENSE
  16. PATENTS
  17. PRESUBMIT.py
  18. README.dart-sdk
  19. README.md
  20. WATCHLISTS
  21. build/
  22. client/
  23. codereview.settings
  24. docs/
  25. pkg/
  26. runtime/
  27. samples-dev/
  28. samples/
  29. sdk/
  30. tests/
  31. third_party/
  32. tools/
  33. utils/
README.md

Dart

Dart is an open-source, scalable programming language, with robust libraries and runtimes, for building web, server, and mobile apps.

Using Dart

Visit the dartlang.org to learn more about the language, tools, getting started, and more.

Browse pub.dartlang.org for more packages and libraries contributed by the community and the Dart team.

Building Dart

If you want to build Dart yourself, here is a guide to getting the source, preparing your machine to build the SDK, and building.

There are more documents on our wiki.

Contributing to Dart

The easiest way to contribute to Dart is to file issues.

You can also contribute patches, as described in Contributing.

License & patents

See LICENSE and PATENTS.