Author: danielsh Date: Thu Aug 10 18:14:13 2017 New Revision: 1804691 URL: http://svn.apache.org/viewvc?rev=1804691&view=rev Log: Fix CVE-2017-9800.
See: https://subversion.apache.org/security/CVE-2017-0800-advisory.txt * subversion/libsvn_ra_svn/client.c (svn_ctype.h): Include. (find_tunnel_agent): Pass a "--" end-of-options guard to ssh. Expect the 'hostinfo' parameter to be URI-decoded. (is_valid_hostinfo): New. (ra_svn_open): Validate the hostname before using it. * subversion/libsvn_subr/config_file.c (svn_config_ensure): Update the example configuration likewise. Patch by: philip Review by: danielsh stsp astieger (earlier version) Modified: subversion/trunk/subversion/libsvn_ra_svn/client.c subversion/trunk/subversion/libsvn_subr/config_file.c Modified: subversion/trunk/subversion/libsvn_ra_svn/client.c URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/libsvn_ra_svn/client.c?rev=1804691&r1=1804690&r2=1804691&view=diff ============================================================================== --- subversion/trunk/subversion/libsvn_ra_svn/client.c (original) +++ subversion/trunk/subversion/libsvn_ra_svn/client.c Thu Aug 10 18:14:13 2017 @@ -46,6 +46,7 @@ #include "svn_props.h" #include "svn_mergeinfo.h" #include "svn_version.h" +#include "svn_ctype.h" #include "svn_private_config.h" @@ -398,7 +399,7 @@ static svn_error_t *find_tunnel_agent(co * versions have it too. If the user is using some other ssh * implementation that doesn't accept it, they can override it * in the [tunnels] section of the config. */ - val = "$SVN_SSH ssh -q"; + val = "$SVN_SSH ssh -q --"; } if (!val || !*val) @@ -443,7 +444,7 @@ static svn_error_t *find_tunnel_agent(co for (n = 0; cmd_argv[n] != NULL; n++) argv[n] = cmd_argv[n]; - argv[n++] = svn_path_uri_decode(hostinfo, pool); + argv[n++] = hostinfo; argv[n++] = "svnserve"; argv[n++] = "-t"; argv[n] = NULL; @@ -811,6 +812,32 @@ ra_svn_get_schemes(apr_pool_t *pool) } +/* A simple whitelist to ensure the following are valid: + * user@server + * [::1]:22 + * server-name + * server_name + * 127.0.0.1 + * with an extra restriction that a leading '-' is invalid. + */ +static svn_boolean_t +is_valid_hostinfo(const char *hostinfo) +{ + const char *p = hostinfo; + + if (p[0] == '-') + return FALSE; + + while (*p) + { + if (!svn_ctype_isalnum(*p) && !strchr(":.-_[]@", *p)) + return FALSE; + + ++p; + } + + return TRUE; +} static svn_error_t *ra_svn_open(svn_ra_session_t *session, const char **corrected_url, @@ -844,8 +871,18 @@ static svn_error_t *ra_svn_open(svn_ra_s || (callbacks->check_tunnel_func && callbacks->open_tunnel_func && !callbacks->check_tunnel_func(callbacks->tunnel_baton, tunnel)))) - SVN_ERR(find_tunnel_agent(tunnel, uri.hostinfo, &tunnel_argv, config, - result_pool)); + { + const char *decoded_hostinfo; + + decoded_hostinfo = svn_path_uri_decode(uri.hostinfo, result_pool); + + if (!is_valid_hostinfo(decoded_hostinfo)) + return svn_error_createf(SVN_ERR_BAD_URL, NULL, _("Invalid host '%s'"), + uri.hostinfo); + + SVN_ERR(find_tunnel_agent(tunnel, decoded_hostinfo, &tunnel_argv, + config, result_pool)); + } else tunnel_argv = NULL; Modified: subversion/trunk/subversion/libsvn_subr/config_file.c URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/libsvn_subr/config_file.c?rev=1804691&r1=1804690&r2=1804691&view=diff ============================================================================== --- subversion/trunk/subversion/libsvn_subr/config_file.c (original) +++ subversion/trunk/subversion/libsvn_subr/config_file.c Thu Aug 10 18:14:13 2017 @@ -1448,12 +1448,12 @@ svn_config_ensure(const char *config_dir "### passed to the tunnel agent as <user>@<hostname>.) If the" NL "### built-in ssh scheme were not predefined, it could be defined" NL "### as:" NL - "# ssh = $SVN_SSH ssh -q" NL + "# ssh = $SVN_SSH ssh -q --" NL "### If you wanted to define a new 'rsh' scheme, to be used with" NL "### 'svn+rsh:' URLs, you could do so as follows:" NL - "# rsh = rsh" NL + "# rsh = rsh --" NL "### Or, if you wanted to specify a full path and arguments:" NL - "# rsh = /path/to/rsh -l myusername" NL + "# rsh = /path/to/rsh -l myusername --" NL "### On Windows, if you are specifying a full path to a command," NL "### use a forward slash (/) or a paired backslash (\\\\) as the" NL "### path separator. A single backslash will be treated as an" NL
