Southparkfan has uploaded a new change for review.

  https://gerrit.wikimedia.org/r/237250

Change subject: Escape all shell arguments & sanitize filenames
......................................................................

Escape all shell arguments & sanitize filenames

Code for the filename sanitization was stolen from the HTMLets extension.

Change-Id: I0195fb2266bf2bda5e80bd10d9a2862e226515a8
(cherry picked from commit a327c57ea0c0ada66c0d1b2124ac52351f5be361)
---
M Git2Pages.php
M GitRepository.php
2 files changed, 17 insertions(+), 9 deletions(-)


  git pull ssh://gerrit.wikimedia.org:29418/mediawiki/extensions/Git2Pages 
refs/changes/50/237250/1

diff --git a/Git2Pages.php b/Git2Pages.php
index 59ac349..c3fec7c 100644
--- a/Git2Pages.php
+++ b/Git2Pages.php
@@ -7,7 +7,7 @@
     'path' => __FILE__,
     'name' => 'Git2Pages',
     'descriptionmsg' => 'git2pages-desc',
-    'version' => '1.1.0',
+    'version' => '1.1.1',
     'author' => array( 'Teresa Cho' , 'Himeshi de Silva' ),
     'url' => 'https://www.mediawiki.org/wiki/Extension:Git2Pages',
 );
diff --git a/GitRepository.php b/GitRepository.php
index 3ac4abd..eb58b1d 100644
--- a/GitRepository.php
+++ b/GitRepository.php
@@ -42,11 +42,11 @@
                $sparseCheckoutFile = '.git/info/sparse-checkout';
                if( $file = file_get_contents( $gitFolder . DIRECTORY_SEPARATOR 
. $sparseCheckoutFile ) ) {
                        if( strpos( $file, $checkoutItem ) === false ) {
-                               wfShellExec( 'echo ' . $checkoutItem . ' >> ' . 
$sparseCheckoutFile );
+                               wfShellExec( 'echo ' . wfEscapeShellArg( 
$checkoutItem ) . ' >> ' . wfEscapeShellArg( $sparseCheckoutFile ) );
                        }
                } else {
-                       wfShellExec( 'touch ' . $sparseCheckoutFile );
-                       wfShellExec( 'echo ' . $checkoutItem . ' >> ' . 
$sparseCheckoutFile );
+                       wfShellExec( 'touch ' . wfEscapeShellArg( 
$sparseCheckoutFile ) );
+                       wfShellExec( 'echo ' . wfEscapeShellArg( $checkoutItem 
) . ' >> ' . wfEscapeShellArg( $sparseCheckoutFile ) );
                }
                wfShellExec( 'git read-tree -mu HEAD' );
                chdir( $oldDir );
@@ -64,11 +64,11 @@
                        chdir( $gitFolder );
                        $sparseCheckoutFile = '.git/info/sparse-checkout';
                        wfShellExec( 'git init' );
-                       wfShellExec( 'git remote add -f origin ' . $url );
+                       wfShellExec( 'git remote add -f origin ' . 
wfEscapeShellArg( $url ) );
                        wfShellExec( 'git config core.sparsecheckout true' );
-                       wfShellExec( 'touch ' . $sparseCheckoutFile );
-                       wfShellExec( 'echo ' . $checkoutItem . ' >> ' . 
$sparseCheckoutFile );
-                       wfShellExec( 'git pull ' . $url . ' ' . $branch );
+                       wfShellExec( 'touch ' . wfEscapeShellArg( 
$sparseCheckoutFile ) );
+                       wfShellExec( 'echo ' . wfEscapeShellArg( $checkoutItem 
) . ' >> ' . wfEscapeShellArg( sparseCheckoutFile ) );
+                       wfShellExec( 'git pull ' . wfEscapeShellArg( $url ) . ' 
' . wfEscapeShellArg( $branch ) );
                        wfDebug( 'GitRepository: Sparse checkout subdirectory' 
);
                        chdir( $oldDir );
                } else {
@@ -84,7 +84,7 @@
         * @param string $gitFolder is the Git repository in which the branch 
will be checked in
         */
        function GitCheckoutBranch( $branch, $gitFolder ) {
-               wfShellExec( 'git --git-dir=' . $gitFolder . '/.git 
--work-tree=' . $gitFolder . ' checkout ' . $branch );
+               wfShellExec( 'git --git-dir=' . wfEscapeShellArg( $gitFolder ) 
. '/.git --work-tree=' . wfEscapeShellArg( $gitFolder ) . ' checkout ' . 
wfEscapeShellArg( $branch ) );
                wfDebug( 'GitRepository: Changed to branch ' . $branch );
        }
 
@@ -95,7 +95,15 @@
         * @param array $options contains user inputs
         */
        function FindAndReadFile( $filename, $gitFolder, $startLine = 1, 
$endLine = -1 ) {
+               # Remove file separators (dots) and slashes to prevent 
directory traversal attack
+               $filename = preg_replace( '@[\\\\/!]|^\.+?&#@', '', $filename );
                $filePath = $gitFolder . DIRECTORY_SEPARATOR . $filename;
+
+               # Throw an exception if $gitFolder doesn't look like a folder
+               if ( strcmp( $gitFolder, realpath( $filePath ) ) !== 0 ) {
+                       throw new Exception( 'The parameter "$gitFolder" does 
not seem to be a folder.' );
+               }
+
                if( $fileArray = file( $filePath ) ) {
                        if( $endLine == -1 ) {
                                $lineBlock = array_slice( $fileArray, 
$startLine - 1 );

-- 
To view, visit https://gerrit.wikimedia.org/r/237250
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I0195fb2266bf2bda5e80bd10d9a2862e226515a8
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/extensions/Git2Pages
Gerrit-Branch: REL1_25
Gerrit-Owner: Southparkfan <southparkfan...@hotmail.com>

_______________________________________________
MediaWiki-commits mailing list
MediaWiki-commits@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits

Reply via email to