Security problem for the spec file serverside - auto building from tags

[Scott Davis]

http://gist.github.com/285108

on Line 11 you see i include the spec file to get the package info

problem is you could put non friendly stuff in the spec file and it
would execute ... so how do i get around this? any ideas?

[scott davis]

http://github.com/jetviper21/pearfarm_auto_builder/blob/master/lib/repo_interface.php

heres the entire file

[Alan Pinstein]

Oh man I didn't even think of that at first... yeah, that's kind of a
problem.

Maybe run it in a chroot jail?

[Evert]

On Jan 25, 1:01 am, Alan Pinstein <apinst...@mac.com> wrote:
> Oh man I didn't even think of that at first... yeah, that's kind of a  
> problem.
>
> Maybe run it in a chroot jail?
>

I would only do this as a temporary measure. In the long run you'll be
better off switching to an xml or php format.
How about actually using the pear package.xml ? Would there be reasons
against this?

Evert

[scott davis]

The whole idea was to mimic pearhubs functionality but using our same spec format .. but this just keeps getting hairy and gross