From: igor@9lab.org
To: 9front@9front.org
Cc: igor@9lab.org
Subject: [9front] [PATCH] rc-httpd: do not escape FS_ROOT for dir-index and serve-static
Date: Fri, 01 Apr 2022 03:08:06 +0200 [thread overview]
Message-ID: <E08554376DF3AA7E72AF66C7A3829ACB@9lab.org> (raw)
The below diff fixes the rc-httpd issue exposed on 4chan[1] whereby one could
escape FS_ROOT via clever URL manipulations when used with dir-index/serve-static
http-handlers.
The solution makes use of cleanname(1) and checks if the computed
path is still prefixed with FS_ROOT.
I am sure there are other solutions, consider this as one possible suggestion...
[1] https://inbox.vuxu.org/9front/EC93BCF8DB4A22F2A1E6CF0D3FB0C16A@5ess.inri.net/
diff 2367a2aeaec8432e6b059135e49c2fa86e415ae5 uncommitted
--- a/rc/bin/rc-httpd/handlers/dir-index
+++ b/rc/bin/rc-httpd/handlers/dir-index
@@ -2,6 +2,10 @@
PATH_INFO=`{echo $PATH_INFO | urlencode -d}
full_path=$"FS_ROOT^$"PATH_INFO
full_path=$"full_path
+if(! ~ `{cleanname -d$FS_ROOT $full_path} `{cleanname $FS_ROOT}^*){
+ error 503
+ exit
+}
if(! test -d $full_path){
error 404
exit
@@ -14,8 +18,7 @@
if(~ $"NOINDEXFILE ^ $"NOINDEX ''){
ifile=index.htm*
if(! ~ $ifile(1) *'*'){
- PATH_INFO=$ifile(1)
- FS_ROOT=''
+ PATH_INFO=$PATH_INFO^$ifile(1)
exec serve-static
}
}
--- a/rc/bin/rc-httpd/handlers/serve-static
+++ b/rc/bin/rc-httpd/handlers/serve-static
@@ -1,6 +1,10 @@
#!/bin/rc
full_path=`{echo $"FS_ROOT^$"PATH_INFO | urlencode -d}
full_path=$"full_path
+if(! ~ `{cleanname -d$FS_ROOT $full_path} `{cleanname $FS_ROOT}^*){
+ error 503
+ exit
+}
if(~ $full_path */)
error 503
if(test -d $full_path){
reply other threads:[~2022-04-01 1:17 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=E08554376DF3AA7E72AF66C7A3829ACB@9lab.org \
--to=igor@9lab.org \
--cc=9front@9front.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).