|
 |
ca3075 |
From 094704af59677596e09d5205a801aa26ef477378 Mon Sep 17 00:00:00 2001
|
|
|
ca3075 |
From: =?UTF-8?q?Ale=C5=A1=20Mat=C4=9Bj?= <amatej@redhat.com>
|
|
|
ca3075 |
Date: Thu, 13 Aug 2020 13:48:58 +0200
|
|
|
ca3075 |
Subject: [PATCH] Validate path read from repomd.xml (RhBug:1866500)
|
|
|
ca3075 |
|
|
|
ca3075 |
---
|
|
|
ca3075 |
librepo/yum.c | 16 ++++++++++++++++
|
|
|
ca3075 |
1 file changed, 16 insertions(+)
|
|
|
ca3075 |
|
|
|
ca3075 |
diff --git a/librepo/yum.c b/librepo/yum.c
|
|
|
ca3075 |
index 6d36562..a5eeb9c 100644
|
|
|
ca3075 |
--- a/librepo/yum.c
|
|
|
ca3075 |
+++ b/librepo/yum.c
|
|
|
ca3075 |
@@ -22,6 +22,7 @@
|
|
|
ca3075 |
#define _DEFAULT_SOURCE
|
|
|
ca3075 |
|
|
|
ca3075 |
#include <stdio.h>
|
|
|
ca3075 |
+#include <libgen.h>
|
|
|
ca3075 |
#include <assert.h>
|
|
|
ca3075 |
#include <stdlib.h>
|
|
|
ca3075 |
#include <errno.h>
|
|
|
ca3075 |
@@ -573,6 +574,21 @@ prepare_repo_download_targets(LrHandle *handle,
|
|
|
ca3075 |
if (!lr_yum_repomd_record_enabled(handle, record->type, repomd->records))
|
|
|
ca3075 |
continue;
|
|
|
ca3075 |
|
|
|
ca3075 |
+ char *dest_dir = realpath(handle->destdir, NULL);
|
|
|
ca3075 |
+ path = lr_pathconcat(handle->destdir, record->location_href, NULL);
|
|
|
ca3075 |
+ char *requested_dir = realpath(dirname(path), NULL);
|
|
|
ca3075 |
+ lr_free(path);
|
|
|
ca3075 |
+ if (!g_str_has_prefix(requested_dir, dest_dir)) {
|
|
|
ca3075 |
+ g_debug("%s: Invalid path: %s", __func__, record->location_href);
|
|
|
ca3075 |
+ g_set_error(err, LR_YUM_ERROR, LRE_IO, "Invalid path: %s", record->location_href);
|
|
|
ca3075 |
+ g_slist_free_full(*targets, (GDestroyNotify) lr_downloadtarget_free);
|
|
|
ca3075 |
+ free(requested_dir);
|
|
|
ca3075 |
+ free(dest_dir);
|
|
|
ca3075 |
+ return FALSE;
|
|
|
ca3075 |
+ }
|
|
|
ca3075 |
+ free(requested_dir);
|
|
|
ca3075 |
+ free(dest_dir);
|
|
|
ca3075 |
+
|
|
|
ca3075 |
path = lr_pathconcat(destdir, record->location_href, NULL);
|
|
|
ca3075 |
fd = open(path, O_CREAT|O_TRUNC|O_RDWR, 0666);
|
|
|
ca3075 |
if (fd < 0) {
|
|
|
ca3075 |
--
|
|
|
ca3075 |
2.28.0
|
|
|
ca3075 |
|