cherry-pick the fix for MPR#7557 from 4.04

3 files changed, 32 insertions, 2 deletions

diff --git a/otherlibs/unix/unix.ml b/otherlibs/unix/unix.ml
index 0bf5071bc3..fa7f90d1a3 100644
--- a/otherlibs/unix/unix.ml
+++ b/otherlibs/unix/unix.ml
@@ -187,6 +187,7 @@ let handle_unix_error f arg =
 
 external environment : unit -> string array = "unix_environment"
 external getenv: string -> string = "caml_sys_getenv"
+(* external unsafe_getenv: string -> string = "caml_sys_unsafe_getenv" *)
 external putenv: string -> string -> unit = "unix_putenv"
 
 type process_status =
diff --git a/otherlibs/unix/unix.mli b/otherlibs/unix/unix.mli
index 5cde58bf78..75121cf726 100644
--- a/otherlibs/unix/unix.mli
+++ b/otherlibs/unix/unix.mli
@@ -125,10 +125,25 @@ val environment : unit -> string array
 
 val getenv : string -> string
 (** Return the value associated to a variable in the process
+   environment, unless the process has special privileges.
+   @raise Not_found if the variable is unbound or the process has
+   special privileges.
+
+   (This function is identical to {!Sys.getenv}. *)
+
+(*
+val unsafe_getenv : string -> string
+(** Return the value associated to a variable in the process
    environment.
-   @raise Not_found if the variable is unbound.
 
-   (This function is identical to {!Sys.getenv}.) *)
+   Unlike {!getenv}, this function returns the value even if the
+   process has special privileges. It is considered unsafe because the
+   programmer of a setuid program must be careful to prevent execution
+   of arbitrary commands through manipulation of the environment
+   variables.
+
+   @raise Not_found if the variable is unbound.  *)
+*)
 
 val putenv : string -> string -> unit
 (** [Unix.putenv name value] sets the value associated to a
diff --git a/otherlibs/unix/unixLabels.mli b/otherlibs/unix/unixLabels.mli
index b65e8b12dc..c6289cab80 100644
--- a/otherlibs/unix/unixLabels.mli
+++ b/otherlibs/unix/unixLabels.mli
@@ -126,6 +126,20 @@ val getenv : string -> string
    environment. Raise [Not_found] if the variable is unbound.
    (This function is identical to [Sys.getenv].) *)
 
+(*
+val unsafe_getenv : string -> string
+(** Return the value associated to a variable in the process
+   environment.
+
+   Unlike {!getenv}, this function returns the value even if the
+   process has special privileges. It is considered unsafe because the
+   programmer of a setuid program must be careful to prevent execution
+   of arbitrary commands through manipulation of the environment
+   variables.
+
+   @raise Not_found if the variable is unbound.  *)
+*)
+
 val putenv : string -> string -> unit
 (** [Unix.putenv name value] sets the value associated to a
    variable in the process environment.