From 66c186802dc7d79b9f6c0b7315315296e4e5cd2f Mon Sep 17 00:00:00 2001
From: CPANSec Security Scanner Bot <cpan-security@security.metacpan.org>
Date: Fri, 6 Nov 2026 18:03:26 +0000
Subject: [PATCH] normalize_params: refuse tz values that are file paths

A tz query parameter was copied to $ENV{TZ} and passed to tzset(), and
glibc opens a TZ value that is a path, so ?tz=/path/to/fifo blocked the
CGI process. Values starting with "/" or ":/" or containing ".." are now
ignored with a warning; tz() set from code is unchanged.
---
 lib/RRD/CGI/Image.pm | 10 +++++++++-
 t/01-tz.t            | 20 ++++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)
 create mode 100644 t/01-tz.t

diff --git a/lib/RRD/CGI/Image.pm b/lib/RRD/CGI/Image.pm
index 68ff0d7..338151d 100644
--- a/lib/RRD/CGI/Image.pm
+++ b/lib/RRD/CGI/Image.pm
@@ -62,7 +62,13 @@ sub normalize_params {
 
 		# Set and strip any timezone params - it's not a valid RRDs::graph() argument
 		if ( $k =~ /tz/i ) {
-			$self->tz( $v );
+			# glibc opens a TZ value that is a path, so refuse paths from the query
+			if ( defined $v && $v =~ m{^:?/|\.\.} ) {
+				warn "Bad tz value";
+			}
+			else {
+				$self->tz( $v );
+			}
 			next;
 		}
 		
@@ -137,6 +143,8 @@ The graph will be sent to the location specified by output_file(); STDOUT by def
 
 In addition to the regular rrdgraph options, you can also add a B<tz=timezone> param which will render the graph in the given timezone.
 
+A B<tz> value that is a file path (it starts with "/" or ":/", or contains "..") is ignored with a warning.
+
 The key-value pairs need a little translation to get them successfully passed through the URL. Your URL or CGI library will probably handle most of this automatically. Here's the full examplanation.
 
 Let's convert a fairly standard set of args for RRDs::graph() to GET-style CGI params, starting with:
diff --git a/t/01-tz.t b/t/01-tz.t
new file mode 100644
index 0000000..039b409
--- /dev/null
+++ b/t/01-tz.t
@@ -0,0 +1,20 @@
+use strict;
+use Test::More tests => 4;
+
+use RRD::CGI::Image;
+
+delete $ENV{TZ};
+my $image = RRD::CGI::Image->new;
+$image->params( [ '--start' => '-1d', 'tz' => '/dev/null', 'tz' => ':/dev/null',
+                  'tz' => '%2Fdev%2Fnull', 'tz' => '../../../../dev/null' ] );
+$image->normalize_params;
+ok( !defined $ENV{TZ}, 'tz values that are paths do not reach $ENV{TZ}' );
+is_deeply( $image->params, [ '--start' => '-1d' ], 'tz params are stripped' );
+
+$image->params( [ '--start' => '-1d', 'tz' => 'Asia/Tokyo' ] );
+$image->normalize_params;
+is( $ENV{TZ}, 'Asia/Tokyo', 'zone name is accepted' );
+
+$image->params( [ '--start' => '-1d', 'tz' => 'EST5EDT,M3.2.0,M11.1.0' ] );
+$image->normalize_params;
+is( $ENV{TZ}, 'EST5EDT,M3.2.0,M11.1.0', 'POSIX TZ rule is accepted' );
-- 
2.53.0