Repository navigation
BUG - Dangerous use of aas_expandpathbyvars in aa_init #288
Description
In aa_init, the full aap structure is parsed and updated through aas_expandpathbyvars, without any checks whether the fields are meant as paths, or are another type of information. This can lead to unexpected content in the aap, where contents of a meant-as-literal string are replaced due to aas_expandpathbyvars, if they happen to match an environment variable expression in part of the content of the string.
Activity
tiborauer commentedon Nov 8, 2021
I think it only acts when "$" is detected, which is not a typical character in any setting.
AljenU commentedon Nov 9, 2021
That is true, so in practice it may not happen often, but it is possible. Also, for #289 the chance is higher.
As for a solution, I noticed that in aas_validatepaths, the content type of the xml fields is taken into account. Since aas_expandpathbyvars is meant to expand paths only, it would appear that for the full-aap-as-input case, a similar way of checking could be used.
Additionally, and given that aas_expandpathbyvars is only used in two cases in the code currently, it could be simplified to only accept char-vectors or aap structs (which then need to provide an accompanying schema input). The case where there is a char matrix input has probably not been tested, because that one will give an error unless the size of the replaced part is exactly the same as the size of the replacement. Which only leaves cell array input as an extra and currently unused option, which can easily be handled on the outside.
Do not do aas_expandpathbyvars on windows