From 93e857ee816212baf162715b90c2be053128c4cd Mon Sep 17 00:00:00 2001
From: fyodor <fyodor@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Sat, 12 Apr 2014 00:16:30 +0000
Subject: [PATCH] Add code (taken from Zenmap) to make sure the install
 location of the Ndiff module can be found by the ndiff script

---
 ndiff/scripts/ndiff | 66 ++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 65 insertions(+), 1 deletion(-)

diff --git a/ndiff/scripts/ndiff b/ndiff/scripts/ndiff
index 23ca33320..07fe8ccc9 100755
--- a/ndiff/scripts/ndiff
+++ b/ndiff/scripts/ndiff
@@ -13,9 +13,73 @@
 # David Fifield
 # based on a design by Michael Pattrick
 
-import ndiff
 import sys
 
+# Check if the given directory, and all its parent directories, are owned and
+# writable only by our euid or by root. If symlinks are present, they are
+# recursively checked, up to a limit of SYMLINK_LIMIT.
+# https://www.securecoding.cert.org/confluence/display/seccode/FIO15-C.+Ensure+that+file+operations+are+performed+in+a+secure+directory
+# We use this code for Zenmap too
+SYMLINK_LIMIT = 5
+def is_secure_dir(path, num_symlinks=0):
+    import os
+    import os.path
+    import stat
+
+    if not os.path.isabs(path):
+        return False
+
+    if num_symlinks >= SYMLINK_LIMIT:
+        return False
+
+    dirs = []
+    while True:
+        dirs.append(path)
+        dirname = os.path.dirname(path)
+        if dirname == path:
+            break
+        path = dirname
+    # Traverse root-to-leaf.
+    dirs.reverse()
+
+    for dir in dirs:
+        if os.path.islink(dir):
+            link = os.readlink(dir)
+            if not is_secure_dir(link, num_symlinks + 1):
+                return False
+            continue
+        if not os.path.isdir(dir):
+            return False
+        buf = os.stat(dir)
+        if buf.st_uid != os.geteuid() and buf.st_uid != 0:
+            return False
+        if buf.st_mode & (stat.S_IWGRP | stat.S_IWOTH) != 0:
+            return False
+
+    return True
+
+# Add the install_lib directory to sys.path, the list of directories searched
+# for modules, but don't do it if the directory or its parents may be writable
+# by other users. The following line is replaced by the installation program.
+INSTALL_LIB = '/usr/local/lib/python2.7/site-packages/'
+if INSTALL_LIB is not None and is_secure_dir(INSTALL_LIB):
+    sys.path.append(INSTALL_LIB)
+
+try:
+    import ndiff
+except ImportError, e:
+    print >> sys.stderr, """\
+Could not import the ndiff module: %s.
+I checked in these directories:""" % repr(e.message)
+    for dir in sys.path:
+        print >> sys.stderr, "    %s" % dir
+    print >> sys.stderr, """\
+If you installed Ndiff in another directory, you may have to add the
+modules directory to the PYTHONPATH environment variable."""
+    sys.exit(1)
+
+import ndiff
+
 if __name__ == "__main__":
     sys.excepthook = ndiff.excepthook
     sys.exit(ndiff.main())