===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/session.c,v
retrieving revision 1.300
retrieving revision 1.301
diff -u -r1.300 -r1.301
--- src/usr.bin/ssh/session.c	2018/06/09 03:03:10	1.300
+++ src/usr.bin/ssh/session.c	2018/07/03 10:59:35	1.301
@@ -1,4 +1,4 @@
-/* $OpenBSD: session.c,v 1.300 2018/06/09 03:03:10 djm Exp $ */
+/* $OpenBSD: session.c,v 1.301 2018/07/03 10:59:35 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -778,10 +778,12 @@
  * into the environment.  If the file does not exist, this does nothing.
  * Otherwise, it must consist of empty lines, comments (line starts with '#')
  * and assignments of the form name=value.  No other forms are allowed.
+ * If whitelist is not NULL, then it is interpreted as a pattern list and
+ * only variable names that match it will be accepted.
  */
 static void
 read_environment_file(char ***env, u_int *envsize,
-	const char *filename)
+	const char *filename, const char *whitelist)
 {
 	FILE *f;
 	char *line = NULL, *cp, *value;
@@ -814,6 +816,9 @@
 		 */
 		*value = '\0';
 		value++;
+		if (whitelist != NULL &&
+		    match_pattern_list(cp, whitelist, 0) != 1)
+			continue;
 		child_set_env(env, envsize, cp, value);
 	}
 	free(line);
@@ -882,7 +887,12 @@
 			cp = strchr(ocp, '=');
 			if (*cp == '=') {
 				*cp = '\0';
-				child_set_env(&env, &envsize, ocp, cp + 1);
+				/* Apply PermitUserEnvironment whitelist */
+				if (options.permit_user_env_whitelist == NULL ||
+				    match_pattern_list(ocp,
+				    options.permit_user_env_whitelist, 0) == 1)
+					child_set_env(&env, &envsize,
+					    ocp, cp + 1);
 			}
 			free(ocp);
 		}
@@ -892,7 +902,8 @@
 	if (options.permit_user_env) {
 		snprintf(buf, sizeof buf, "%.200s/.ssh/environment",
 		    pw->pw_dir);
-		read_environment_file(&env, &envsize, buf);
+		read_environment_file(&env, &envsize, buf,
+		    options.permit_user_env_whitelist);
 	}
 
 	/* Environment specified by admin */