From 094704af59677596e09d5205a801aa26ef477378 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ale=C5=A1=20Mat=C4=9Bj?= Date: Thu, 13 Aug 2020 13:48:58 +0200 Subject: [PATCH] Validate path read from repomd.xml (RhBug:1866500) --- librepo/yum.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/librepo/yum.c b/librepo/yum.c index 6d36562..a5eeb9c 100644 --- a/librepo/yum.c +++ b/librepo/yum.c @@ -22,6 +22,7 @@ #define _DEFAULT_SOURCE #include +#include #include #include #include @@ -573,6 +574,21 @@ prepare_repo_download_targets(LrHandle *handle, if (!lr_yum_repomd_record_enabled(handle, record->type, repomd->records)) continue; + char *dest_dir = realpath(handle->destdir, NULL); + path = lr_pathconcat(handle->destdir, record->location_href, NULL); + char *requested_dir = realpath(dirname(path), NULL); + lr_free(path); + if (!g_str_has_prefix(requested_dir, dest_dir)) { + g_debug("%s: Invalid path: %s", __func__, record->location_href); + g_set_error(err, LR_YUM_ERROR, LRE_IO, "Invalid path: %s", record->location_href); + g_slist_free_full(*targets, (GDestroyNotify) lr_downloadtarget_free); + free(requested_dir); + free(dest_dir); + return FALSE; + } + free(requested_dir); + free(dest_dir); + path = lr_pathconcat(destdir, record->location_href, NULL); fd = open(path, O_CREAT|O_TRUNC|O_RDWR, 0666); if (fd < 0) { -- 2.28.0