guix-devel/gnu/packages/patches/fossil-CVE-2017-17459.patch

58 lines
1.5 KiB
Diff
Raw Normal View History

Fix CVE-2017-17459:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17459
Patch copied from upstream source repository:
https://www.fossil-scm.org/xfer/info/1f63db591c77108c
Index: src/http_transport.c
==================================================================
--- src/http_transport.c
+++ src/http_transport.c
@@ -73,10 +73,23 @@
if( resetFlag ){
transport.nSent = 0;
transport.nRcvd = 0;
}
}
+
+/*
+** Remove leading "-" characters from the input string.
+**
+** This prevents attacks that try to trick a victim into using
+** a ssh:// URI with a carefully crafted hostname of other
+** parameter that ends up being interpreted as a command-line
+** option by "ssh".
+*/
+static const char *stripLeadingMinus(const char *z){
+ while( z[0]=='-' ) z++;
+ return z;
+}
/*
** Default SSH command
*/
#ifdef _WIN32
@@ -116,17 +129,17 @@
}else{
zHost = mprintf("%s", pUrlData->name);
}
n = blob_size(&zCmd);
blob_append(&zCmd, " ", 1);
- shell_escape(&zCmd, zHost);
+ shell_escape(&zCmd, stripLeadingMinus(zHost));
blob_append(&zCmd, " ", 1);
shell_escape(&zCmd, mprintf("%s", pUrlData->fossil));
blob_append(&zCmd, " test-http", 10);
if( pUrlData->path && pUrlData->path[0] ){
blob_append(&zCmd, " ", 1);
- shell_escape(&zCmd, mprintf("%s", pUrlData->path));
+ shell_escape(&zCmd, mprintf("%s", stripLeadingMinus(pUrlData->path)));
}
if( g.fSshTrace ){
fossil_print("%s\n", blob_str(&zCmd)+n); /* Show tail of SSH command */
}
free(zHost);