On Tue, Feb 14, 2012 at 7:53 AM, Richard Hipp <[email protected]> wrote:
> > On Mon, Feb 13, 2012 at 9:26 PM, Leo Razoumov <[email protected]> wrote: > >> >> Are TH1 and Tcl interpreters properly sand-boxed? Otherwise, >> downloading and running random scripts found in some random repos does >> not strike me as a sound security. >> >> > The only actions TH1 can take are to output text or HTML into designated > areas of a webpage. TH1 cannot change the repository, cannot write to the > disk, cannot open network connections, cannot read content from external > sources, cannot consume large amounts of memory, cannot loop, and cannot > call external programs or software. TH1 is not a serious threat for > malware. > > TCL can do more mischief, but it is only enabled if you compile with > FOSSIL_ENABLE_TCL, which is off by default, and if you either set the "tcl" > property on your repository or have the TH1_ENABLE_TCL environment variable > set. > > Moving forward, I think I'll make further security enhancements along the > following lines: > > (1) Disable the TH1_ENABLE_TCL environment variable. TCL script > capability is only available if you enable it using the "tcl" property of > the repository. > > (2) Default the "tcl" property to off on a clone, even if it is on in the > parent repo. > > (3) Provide extra setup screens that make it easier to audit scripts for > malware prior to enabling the "tcl" property. At the place where the "tcl" > property is enabled, include text warning users of the potential dangers > and provide buttons or links to places where the TCL script can be audited > for security. > > (4) Scripts are only exchanged between repositories on a "fossil clone" or > "fossil configuration pull/sync". For the latter, detailed warnings about > changes to scripts and recommendations to redo audits might be in order. > (5) If any script changes as a result of "fossil config pull" then the "tcl" property is automatically moved to "off" and the operator is notified. The "tcl" property must be turned back on by a separate manual step, that includes a warning to make sure the modified scripts are secure. > > -- > D. Richard Hipp > [email protected] > -- D. Richard Hipp [email protected]
_______________________________________________ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
