You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@subversion.apache.org by Pavel Lyalyakin <pa...@visualsvn.com> on 2013/03/21 16:42:35 UTC
Environment variables in hook scripts?
Hello,
In the official Apache Subversion FAQ I see the entry:
http://subversion.apache.org/faq.html#hook-debugging.
The entry says:
[[
Before Subversion calls a hook script, it removes all variables --
including $PATH on Unix, and %PATH% on Windows -- from the
environment. Therefore, your script can only run another program if
you spell out that program's absolute name.
]]
Is this statement true?
I've just tested this with Windows 7 64bit and Apache Subversion
1.7.8: NO environment variables get removed.
Am I doing something wrong? Is the FAQ entry obsolete?
--
With best regards,
Pavel Lyalyakin
VisualSVN Team
Re: Environment variables in hook scripts?
Posted by Talden <ta...@gmail.com>.
Whenever I've set up any Windows SVN servers I've always ensured that
everything works without an environment anyway. I anticipated, given the
documentation, that this exact change could occur.
So you could say that a lack of pain is a reward for following the spec
intent :)
--
Aaron Scott-Boddendijk
On Fri, Mar 29, 2013 at 6:33 AM, Branko Čibej <br...@wandisco.com> wrote:
> On 28.03.2013 18:08, Daniel Shahaf wrote:
> > Ben Reser wrote on Thu, Mar 28, 2013 at 09:30:05 -0700:
> >> On Thu, Mar 21, 2013 at 10:41 AM, Branko Čibej <br...@wandisco.com>
> wrote:
> >>> However it would avoid a possible security issue or two as well. IMO
> our
> >>> documentation is correct and we should fix the code to behave as
> documented.
> >> I don't think we ever came to a conclusion on this. However, Bert had
> >> some important comments about how Windows handles the PATH on IRC.
> >>
> >> 17:19 Bert You need PATH to find shared libraries. And many
> tools rely
> >> on environment variables to find out things about the runtime
> >> environment. (E.g. system temp directory)
> >> 17:20 Bert There is no way to obtain that if you remove the
> variable
> >>
> >> Full discussion is here:
> >> http://colabti.org/irclogger/irclogger_log/svn-dev?date=2013-03-21
> > Can we come up with a whitelist of envvars to keep?
> > (PATH, TEMP, TMP, TMPDIR, etc; don't have a windows box handy to examine)
>
> I'm not sure I agree; this is what $repo/conf/hooks-env is for after all.
>
> It's true that Windows keeps "system" and "user" environment variables
> separate, and hook scripts will inherit from httpd (or svnserve) which,
> when run as a service, will only see the system environment. So what
> environment the hook script sees is strictly under the sysadmin's
> control. However, pretty much the same is true on Unix; so if we have a
> valid reason for starting with an empty environment there, we may as
> well do that on Windows, too.
>
> Although I can imagine the pain of migrating every Windows-based SVN
> server to a different scheme for setting the environment.
>
> -- Brane
>
> --
> Branko Čibej
> Director of Subversion | WANdisco | www.wandisco.com
>
>
Re: Environment variables in hook scripts?
Posted by Branko Čibej <br...@wandisco.com>.
On 28.03.2013 18:08, Daniel Shahaf wrote:
> Ben Reser wrote on Thu, Mar 28, 2013 at 09:30:05 -0700:
>> On Thu, Mar 21, 2013 at 10:41 AM, Branko Čibej <br...@wandisco.com> wrote:
>>> However it would avoid a possible security issue or two as well. IMO our
>>> documentation is correct and we should fix the code to behave as documented.
>> I don't think we ever came to a conclusion on this. However, Bert had
>> some important comments about how Windows handles the PATH on IRC.
>>
>> 17:19 Bert You need PATH to find shared libraries. And many tools rely
>> on environment variables to find out things about the runtime
>> environment. (E.g. system temp directory)
>> 17:20 Bert There is no way to obtain that if you remove the variable
>>
>> Full discussion is here:
>> http://colabti.org/irclogger/irclogger_log/svn-dev?date=2013-03-21
> Can we come up with a whitelist of envvars to keep?
> (PATH, TEMP, TMP, TMPDIR, etc; don't have a windows box handy to examine)
I'm not sure I agree; this is what $repo/conf/hooks-env is for after all.
It's true that Windows keeps "system" and "user" environment variables
separate, and hook scripts will inherit from httpd (or svnserve) which,
when run as a service, will only see the system environment. So what
environment the hook script sees is strictly under the sysadmin's
control. However, pretty much the same is true on Unix; so if we have a
valid reason for starting with an empty environment there, we may as
well do that on Windows, too.
Although I can imagine the pain of migrating every Windows-based SVN
server to a different scheme for setting the environment.
-- Brane
--
Branko Čibej
Director of Subversion | WANdisco | www.wandisco.com
Re: Environment variables in hook scripts?
Posted by Daniel Shahaf <d....@daniel.shahaf.name>.
Ben Reser wrote on Thu, Mar 28, 2013 at 09:30:05 -0700:
> On Thu, Mar 21, 2013 at 10:41 AM, Branko Čibej <br...@wandisco.com> wrote:
> > However it would avoid a possible security issue or two as well. IMO our
> > documentation is correct and we should fix the code to behave as documented.
>
> I don't think we ever came to a conclusion on this. However, Bert had
> some important comments about how Windows handles the PATH on IRC.
>
> 17:19 Bert You need PATH to find shared libraries. And many tools rely
> on environment variables to find out things about the runtime
> environment. (E.g. system temp directory)
> 17:20 Bert There is no way to obtain that if you remove the variable
>
> Full discussion is here:
> http://colabti.org/irclogger/irclogger_log/svn-dev?date=2013-03-21
Can we come up with a whitelist of envvars to keep?
(PATH, TEMP, TMP, TMPDIR, etc; don't have a windows box handy to examine)
Re: Environment variables in hook scripts?
Posted by Ben Reser <be...@reser.org>.
On Thu, Mar 21, 2013 at 10:41 AM, Branko Čibej <br...@wandisco.com> wrote:
> However it would avoid a possible security issue or two as well. IMO our
> documentation is correct and we should fix the code to behave as documented.
I don't think we ever came to a conclusion on this. However, Bert had
some important comments about how Windows handles the PATH on IRC.
17:19 Bert You need PATH to find shared libraries. And many tools rely
on environment variables to find out things about the runtime
environment. (E.g. system temp directory)
17:20 Bert There is no way to obtain that if you remove the variable
Full discussion is here:
http://colabti.org/irclogger/irclogger_log/svn-dev?date=2013-03-21
Re: Environment variables in hook scripts?
Posted by Branko Čibej <br...@wandisco.com>.
On 21.03.2013 18:26, Philip Martin wrote:
> Philip Martin <ph...@wandisco.com> writes:
>
>> So it seems that there is a bug in apr_proc_create on Windows.
>> Subversion might be able to work around this bug by explicitly passing
>> an non-null, empty environment to apr_proc_create.
> If Subversion were to start doing this it would probably break lots of
> (most?) existing hook scripts on Windows.
>
However it would avoid a possible security issue or two as well. IMO our
documentation is correct and we should fix the code to behave as documented.
-- Brane
--
Branko Čibej
Director of Subversion | WANdisco | www.wandisco.com
Re: Environment variables in hook scripts?
Posted by Philip Martin <ph...@codematters.co.uk>.
Philip Martin <ph...@wandisco.com> writes:
> So it seems that there is a bug in apr_proc_create on Windows.
> Subversion might be able to work around this bug by explicitly passing
> an non-null, empty environment to apr_proc_create.
If Subversion were to start doing this it would probably break lots of
(most?) existing hook scripts on Windows.
--
Philip
Re: Environment variables in hook scripts?
Posted by Philip Martin <ph...@wandisco.com>.
Pavel Lyalyakin <pa...@visualsvn.com> writes:
> [[
> Before Subversion calls a hook script, it removes all variables --
> including $PATH on Unix, and %PATH% on Windows -- from the
> environment. Therefore, your script can only run another program if
> you spell out that program's absolute name.
> ]]
>
> Is this statement true?
>
> I've just tested this with Windows 7 64bit and Apache Subversion
> 1.7.8: NO environment variables get removed.
It's certainly true for Unix platforms. Subversion first calls
apr_procattr_cmdtype_set setting cmd=APR_PROGRAM and then calls
apr_proc_create passing env=NULL. APR says that APR_PROGRAM doesn't
copy the environment.
On Unix the combination of APR_PROGRAM and env=NULL causes an empty
array to be passed to execve. That gives an empty environment.
On Windows, as far as I can tell by looking at the code, it causes a
null pointer to be passed to CreateProcessW. The Microsoft documentation
says that will cause the environment to be inherited.
So it seems that there is a bug in apr_proc_create on Windows.
Subversion might be able to work around this bug by explicitly passing
an non-null, empty environment to apr_proc_create.
--
Certified & Supported Apache Subversion Downloads:
http://www.wandisco.com/subversion/download