Re: [Flightgear-devel] Nasal security

[Rebecca N. P. <reb...@zo...>]

Looks like some of the test cases in fgInitAllowedPaths() may not 
actually be legal paths, which now matters since we're using realpath(); 
I have just pushed a possible fix, though I can't be sure since my 
(64-bit Linux) system didn't have the issue.

If it still doesn't work, please recompile with this to determine 
exactly what is failing:

diff --git a/src/Main/util.cxx b/src/Main/util.cxx
index 40d3244..aaaa468 100644
--- a/src/Main/util.cxx
+++ b/src/Main/util.cxx
@@ -194,6 +194,7 @@ static std::string fgValidatePath_internal
          }
      }
      // no match found
+    SG_LOG(SG_NASAL, SG_ALERT, "Access denied to " << normed_path);
      return "";
  }
  // Check whether Nasal is allowed to access a path