{"action":"created","issue":{"url":"https://api.github.com/repos/travis-ci/travis-ci/issues/4862","repository_url":"https://api.github.com/repos/travis-ci/travis-ci","labels_url":"https://api.github.com/repos/travis-ci/travis-ci/issues/4862/labels{/name}","comments_url":"https://api.github.com/repos/travis-ci/travis-ci/issues/4862/comments","events_url":"https://api.github.com/repos/travis-ci/travis-ci/issues/4862/events","html_url":"https://github.com/travis-ci/travis-ci/issues/4862","id":108883780,"node_id":"MDU6SXNzdWUxMDg4ODM3ODA=","number":4862,"title":"Build fails, because relative paths are present in PATH.","user":{"login":"kenorb","id":266306,"node_id":"MDQ6VXNlcjI2NjMwNg==","avatar_url":"https://avatars2.githubusercontent.com/u/266306?v=4","gravatar_id":"","url":"https://api.github.com/users/kenorb","html_url":"https://github.com/kenorb","followers_url":"https://api.github.com/users/kenorb/followers","following_url":"https://api.github.com/users/kenorb/following{/other_user}","gists_url":"https://api.github.com/users/kenorb/gists{/gist_id}","starred_url":"https://api.github.com/users/kenorb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kenorb/subscriptions","organizations_url":"https://api.github.com/users/kenorb/orgs","repos_url":"https://api.github.com/users/kenorb/repos","events_url":"https://api.github.com/users/kenorb/events{/privacy}","received_events_url":"https://api.github.com/users/kenorb/received_events","type":"User","site_admin":false},"labels":[{"id":38585573,"node_id":"MDU6TGFiZWwzODU4NTU3Mw==","url":"https://api.github.com/repos/travis-ci/travis-ci/labels/travis-cookbooks","name":"travis-cookbooks","color":"207de5","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2015-09-29T14:37:30Z","updated_at":"2018-10-11T05:33:08Z","closed_at":null,"author_association":"NONE","body":"I've the script which running test by executing the following shell command:\n\n```\nfind . -name \"*.hst\" -execdir python3 convert_mt_to_csv.py -i {} -f hst4 -o {}.csv ';'\n```\n\nThis command fails regardless syntax being used and it refuses to do anything, because PATH in Travis CI consist relative paths.\n\nThis can be seen in [nvm.sh.erb](https://github.com/travis-ci/travis-cookbooks/blob/7926be063565fac6d53ca99b2df6be976e09e041/cookbooks/nodejs/templates/default/nvm.sh.erb) and [profile_entry.sh](https://github.com/travis-ci/travis-cookbooks/blob/7926be063565fac6d53ca99b2df6be976e09e041/cookbooks/nodejs/files/default/profile_entry.sh) as commented by [@BanzaiMan](https://github.com/travis-ci/travis-ci/issues/2811#issuecomment-144045623).\n\nThe example of build failure can be seen in this [build](https://travis-ci.org/FX31337/FX-BT-Scripts/builds/82613738). which fails with the following error:\n\n> find: The relative path `./node_modules/.bin' is included in the PATH environment variable, which is insecure in combination with the -execdir action of find.  Please remove that entry from $PATH\n\nand when applying the [PATH workaround](https://github.com/d-a-t-a-d-i-t/FX-BT-Scripts/commit/f3aea061af5d76f77fa443a1fd7760999a7557e8) shown below, it works fine.\n\nWe can read in `man find`:\n\n> The ‘-execdir’ action refuses to do anything if the current directory is included in the $PATH environment variable. This is necessary because ‘-execdir’ runs programs in the same directory in which it finds files – in general, such a directory might be writable by untrusted users. For similar reasons, ‘-execdir’ does not allow ‘{}’ to appear in the name of the command to be run.\n\nSee also: [Why using the '-execdir' action is insecure for directory which is in the PATH?](http://askubuntu.com/q/621132/78223)\n\nThis has been discussed in here: https://github.com/travis-ci/travis-ci/issues/2811\n\nAnd it seems the only workaround so far is to remove that entry from PATH manually by:\n\n```\nbefore_script:\n  - PATH=${PATH//:\\.\\/node_modules\\/\\.bin/}\n```\n\nThe suggested solution by [@BanzaiMan](https://github.com/travis-ci/travis-ci/issues/2811#issuecomment-144045623) is to [remove this from the cookbooks](https://github.com/travis-ci/travis-cookbooks/commit/670cb77cab03adb60986425cf192d753797ffd8a).\n"},"comment":{"url":"https://api.github.com/repos/travis-ci/travis-ci/issues/comments/428826288","html_url":"https://github.com/travis-ci/travis-ci/issues/4862#issuecomment-428826288","issue_url":"https://api.github.com/repos/travis-ci/travis-ci/issues/4862","id":428826288,"node_id":"MDEyOklzc3VlQ29tbWVudDQyODgyNjI4OA==","user":{"login":"stale[bot]","id":26384082,"node_id":"MDM6Qm90MjYzODQwODI=","avatar_url":"https://avatars3.githubusercontent.com/in/1724?v=4","gravatar_id":"","url":"https://api.github.com/users/stale%5Bbot%5D","html_url":"https://github.com/apps/stale","followers_url":"https://api.github.com/users/stale%5Bbot%5D/followers","following_url":"https://api.github.com/users/stale%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/stale%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/stale%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stale%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/stale%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/stale%5Bbot%5D/repos","events_url":"https://api.github.com/users/stale%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/stale%5Bbot%5D/received_events","type":"Bot","site_admin":false},"created_at":"2018-10-11T05:33:08Z","updated_at":"2018-10-11T05:33:08Z","author_association":"NONE","body":"Thanks for contributing to this issue. As it has been 90 days since the last activity, we are automatically closing the issue in 7 days. This is often because the request was already solved in some way and it just wasn't updated or it's no longer applicable. If that's not the case, please respond before the issue is closed, or open a new one after. We'll gladly take a look again! You can read more here: https://blog.travis-ci.com/2018-03-09-closing-old-issues\n"}}
{"actor":{"display_login":"stale"}}