9front - general discussion about 9front
 help / color / mirror / Atom feed
From: igor@9lab.org
To: 9front@9front.org
Cc: igor@9lab.org
Subject: [9front] [PATCH] rc-httpd: do not escape FS_ROOT for dir-index and serve-static
Date: Fri, 01 Apr 2022 03:08:06 +0200	[thread overview]
Message-ID: <E08554376DF3AA7E72AF66C7A3829ACB@9lab.org> (raw)

The below diff fixes the rc-httpd issue exposed on 4chan[1] whereby one could
escape FS_ROOT via clever URL manipulations when used with dir-index/serve-static
http-handlers.

The solution makes use of cleanname(1) and checks if the computed
path is still prefixed with FS_ROOT.

I am sure there are other solutions, consider this as one possible suggestion...

[1] https://inbox.vuxu.org/9front/EC93BCF8DB4A22F2A1E6CF0D3FB0C16A@5ess.inri.net/


diff 2367a2aeaec8432e6b059135e49c2fa86e415ae5 uncommitted
--- a/rc/bin/rc-httpd/handlers/dir-index
+++ b/rc/bin/rc-httpd/handlers/dir-index
@@ -2,6 +2,10 @@
 PATH_INFO=`{echo $PATH_INFO | urlencode -d}
 full_path=$"FS_ROOT^$"PATH_INFO
 full_path=$"full_path
+if(! ~ `{cleanname -d$FS_ROOT $full_path} `{cleanname $FS_ROOT}^*){
+	error 503
+	exit
+}
 if(! test -d $full_path){
 	error 404
 	exit
@@ -14,8 +18,7 @@
 if(~ $"NOINDEXFILE ^ $"NOINDEX ''){
 	ifile=index.htm*
 	if(! ~ $ifile(1) *'*'){
-		PATH_INFO=$ifile(1)
-		FS_ROOT=''
+		PATH_INFO=$PATH_INFO^$ifile(1)
 		exec serve-static
 	}
 }
--- a/rc/bin/rc-httpd/handlers/serve-static
+++ b/rc/bin/rc-httpd/handlers/serve-static
@@ -1,6 +1,10 @@
 #!/bin/rc
 full_path=`{echo $"FS_ROOT^$"PATH_INFO | urlencode -d}
 full_path=$"full_path
+if(! ~ `{cleanname -d$FS_ROOT $full_path} `{cleanname $FS_ROOT}^*){
+	error 503
+	exit
+}
 if(~ $full_path */)
 	error 503
 if(test -d $full_path){


                 reply	other threads:[~2022-04-01  1:17 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=E08554376DF3AA7E72AF66C7A3829ACB@9lab.org \
    --to=igor@9lab.org \
    --cc=9front@9front.org \
    --subject='Re: [9front] [PATCH] rc-httpd: do not escape FS_ROOT for dir-index and serve-static' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).