On Sun, 2018-02-18 at 22:27 +0100, Jakub Wilk wrote: > You don't need trailing undef here.
Tested, removed > SSH protocol has an alternative scp-like syntax: Added, hope I got the regex right. > There are also two syntaxes for local repositories, although I think > neither should be allowed. It's *web*checkout after all... Blocked those. Updated patch attached. -- bye, pabs https://wiki.debian.org/PaulWise
From e6a81edb53d8c4501017a81013e075da80cbcc19 Mon Sep 17 00:00:00 2001 From: Paul Wise <pa...@bonedaddy.net> Date: Sun, 11 Feb 2018 21:57:49 +0800 Subject: [PATCH] Mitigate vulnerabilities caused by some git remotes being able to execute code Set GIT_PROTOCOL_FROM_USER=0 with git versions newer than 2.12. Prevent remote websites from causing cloning of local repositories. Manually whitelist known-safe protocols (http, https, git, ssh) when using git versions older than 2.12. Fixes: CVE-2018-7032 Fixes: https://bugs.debian.org/840014 --- webcheckout | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/webcheckout b/webcheckout index e98da5c..b0f2433 100755 --- a/webcheckout +++ b/webcheckout @@ -71,6 +71,16 @@ use Getopt::Long; use warnings; use strict; +# Mitigate some git remote types being dangerous +my $git_unsafe = 1; +my $git_version = `git --version`; +$git_version =~ s{^git version }{}; +my ($major, $minor) = split(/\./, $git_version); +if (int($major) >= 2 && int($minor) >= 12) { + $ENV{GIT_PROTOCOL_FROM_USER} = 0; + $git_unsafe = 0; +} + # What to download. my $url; @@ -89,7 +99,17 @@ my $destdir; # how to perform checkouts my %handlers=( - git => sub { doit(qw(git clone --), shift, $destdir) }, + git => sub { + my $git_url = shift; + # Reject unsafe URLs with older versions of git + # that do not already check the URL safety. + if ($git_unsafe && $git_url !~ m{^(?:(?:https?|git|ssh):[^:]|(?:[-_.a-z0-9]+@)?[-_.a-z0-9]+:(?:[^:]|$))}) { + print STDERR "potentially unsafe git URL, may fail, touch local files or execute arbitrary code\n"; + return 1; + } + # Reject cloning local directories too, this is for remote repos + doit(qw(git clone -c protocol.file.allow=user --), $git_url, $destdir) + }, svn => sub { doit(qw(svn checkout --), shift, $destdir) }, bzr => sub { doit(qw(bzr branch --), shift, $destdir) }, ); -- 2.16.1
signature.asc
Description: This is a digitally signed message part
