File 0002-reposync-fix-up-path-traversal-prevention.... of Package dnf-plugins-core

Overview Repositories Revisions Requests Users Attributes Meta

File 0002-reposync-fix-up-path-traversal-prevention.patch of Package dnf-plugins-core (Revision b47753dc18459732cffac7f5edb40fa9)

Currently displaying revision b47753dc18459732cffac7f5edb40fa9 , Show latest

From 0631f863ec7948484df10f5dc16c774d5815326a Mon Sep 17 00:00:00 2001
From: Michal Domonkos <mdomonko@redhat.com>
Date: Thu, 3 Jan 2019 15:58:06 +0100
Subject: [PATCH 2/3] reposync: fix-up path traversal prevention

Previously, pkg_download_path() would still pass if the target path was
a "sibling" of the destination directory.

Example:

repo_target = '/tmp/myrepo'
  pkg_download_path = '../myrepo2/evil_file'
  ...
  # final path that passes the check:
  pkg_download_path = '/tmp/myrepo2/evil_file'
                      # ^ this is a superstring of repo_target!

This commit prevents that by making sure repo_target ends with a path
separator before it is passed to startswith().  We achieve that by
simply using join() with an empty string (see python docs).

In addition, normpath() is replaced by realpath() to account for
symlinks that could also carry us outside repo_target.

Resolves RHEL-8 bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1600722
---
 plugins/reposync.py | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/plugins/reposync.py b/plugins/reposync.py
index 29b911e..0d72f55 100644
--- a/plugins/reposync.py
+++ b/plugins/reposync.py
@@ -32,7 +32,7 @@ import dnf.cli
 
 def _pkgdir(intermediate, target):
     cwd = dnf.i18n.ucd(os.getcwd())
-    return os.path.normpath(os.path.join(cwd, intermediate, target))
+    return os.path.realpath(os.path.join(cwd, intermediate, target))
 
 
 class RPMPayloadLocation(dnf.repo.RPMPayload):
@@ -118,9 +118,12 @@ class RepoSyncCommand(dnf.cli.Command):
 
     def pkg_download_path(self, pkg):
         repo_target = self.repo_target(pkg.repo)
-        pkg_download_path = os.path.normpath(
+        pkg_download_path = os.path.realpath(
             os.path.join(repo_target, pkg.location))
-        if not pkg_download_path.startswith(repo_target):
+        # join() ensures repo_target ends with a path separator (otherwise the
+        # check would pass if pkg_download_path was a "sibling" path component
+        # of repo_target that has the same prefix).
+        if not pkg_download_path.startswith(os.path.join(repo_target, '')):
             raise dnf.exceptions.Error(
                 _("Download target '{}' is outside of download path '{}'.").format(
                     pkg_download_path, repo_target))
-- 
2.20.1

Places

File 0002-reposync-fix-up-path-traversal-prevention.patch of Package dnf-plugins-core (Revision b47753dc18459732cffac7f5edb40fa9)

Places