|
 |
15e88b |
From feccde6a9f0d0d1abbe2fdf32faf8c81aa8bb4c7 Mon Sep 17 00:00:00 2001
|
|
|
15e88b |
From: Stef Walter <stefw@redhat.com>
|
|
|
15e88b |
Date: Sun, 9 Sep 2018 11:05:05 +0200
|
|
|
15e88b |
Subject: [PATCH 2/2] src: Deny using %2F when serving file paths
|
|
|
15e88b |
|
|
|
15e88b |
The two invalid characters in Unix file names are zero and /.
|
|
|
15e88b |
Deny using this in an encoded form, since it bypasses how paths
|
|
|
15e88b |
are broken apart in HTTP URLs.
|
|
|
15e88b |
|
|
|
15e88b |
Closes #10028
|
|
|
15e88b |
---
|
|
|
15e88b |
src/common/cockpitwebresponse.c | 2 +-
|
|
|
15e88b |
src/common/test-webresponse.c | 18 ++++++++++++++++++
|
|
|
15e88b |
2 files changed, 19 insertions(+), 1 deletion(-)
|
|
|
15e88b |
|
|
|
15e88b |
diff --git a/src/common/cockpitwebresponse.c b/src/common/cockpitwebresponse.c
|
|
|
15e88b |
index d156bc319..0e757f345 100644
|
|
|
15e88b |
--- a/src/common/cockpitwebresponse.c
|
|
|
15e88b |
+++ b/src/common/cockpitwebresponse.c
|
|
|
15e88b |
@@ -1299,7 +1299,7 @@ web_response_file (CockpitWebResponse *response,
|
|
|
15e88b |
g_return_if_fail (escaped != NULL);
|
|
|
15e88b |
|
|
|
15e88b |
/* Someone is trying to escape the root directory, or access hidden files? */
|
|
|
15e88b |
- unescaped = g_uri_unescape_string (escaped, NULL);
|
|
|
15e88b |
+ unescaped = g_uri_unescape_string (escaped, "/");
|
|
|
15e88b |
if (!unescaped || strstr (unescaped, "/.") || strstr (unescaped, "../") || strstr (unescaped, "//"))
|
|
|
15e88b |
{
|
|
|
15e88b |
g_debug ("%s: invalid path request", escaped);
|
|
|
15e88b |
diff --git a/src/common/test-webresponse.c b/src/common/test-webresponse.c
|
|
|
15e88b |
index 4ad72b967..ab59c13e5 100644
|
|
|
15e88b |
--- a/src/common/test-webresponse.c
|
|
|
15e88b |
+++ b/src/common/test-webresponse.c
|
|
|
15e88b |
@@ -309,6 +309,22 @@ test_file_encoding_denied (TestCase *tc,
|
|
|
15e88b |
free (root);
|
|
|
15e88b |
}
|
|
|
15e88b |
|
|
|
15e88b |
+static void
|
|
|
15e88b |
+test_file_slash_denied (TestCase *tc,
|
|
|
15e88b |
+ gconstpointer user_data)
|
|
|
15e88b |
+{
|
|
|
15e88b |
+ gchar *root = realpath ( SRCDIR "/src", NULL);
|
|
|
15e88b |
+ const gchar *roots[] = { root, NULL };
|
|
|
15e88b |
+ const gchar *breakout = "/common%2fMakefile-common.am";
|
|
|
15e88b |
+ gchar *check = g_build_filename (roots[0], "common", "Makefile-common.am", NULL);
|
|
|
15e88b |
+ g_assert (root);
|
|
|
15e88b |
+ g_assert (g_file_test (check, G_FILE_TEST_EXISTS));
|
|
|
15e88b |
+ g_free (check);
|
|
|
15e88b |
+ cockpit_web_response_file (tc->response, breakout, roots);
|
|
|
15e88b |
+ cockpit_assert_strmatch (output_as_string (tc), "HTTP/1.1 404*");
|
|
|
15e88b |
+ free (root);
|
|
|
15e88b |
+}
|
|
|
15e88b |
+
|
|
|
15e88b |
static void
|
|
|
15e88b |
test_file_breakout_non_existant (TestCase *tc,
|
|
|
15e88b |
gconstpointer user_data)
|
|
|
15e88b |
@@ -1440,6 +1456,8 @@ main (int argc,
|
|
|
15e88b |
setup, test_file_breakout_denied, teardown);
|
|
|
15e88b |
g_test_add ("/web-response/file/invalid-encoding-denied", TestCase, NULL,
|
|
|
15e88b |
setup, test_file_encoding_denied, teardown);
|
|
|
15e88b |
+ g_test_add ("/web-response/file/file-slash-denied", TestCase, NULL,
|
|
|
15e88b |
+ setup, test_file_slash_denied, teardown);
|
|
|
15e88b |
g_test_add ("/web-response/file/breakout-non-existant", TestCase, NULL,
|
|
|
15e88b |
setup, test_file_breakout_non_existant, teardown);
|
|
|
15e88b |
g_test_add ("/web-reponse/file/template", TestCase, &template_fixture,
|
|
|
15e88b |
--
|
|
|
15e88b |
2.17.1
|
|
|
15e88b |
|