[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <50C9B815.606@debian.org>
Date: Thu, 13 Dec 2012 11:12:21 +0000
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: Geany IDE not escaping filenames during compilation
/ build - a security issue or not?
On 12/12/12 16:51, Jan Lieskovsky wrote:
> 1) should Geany escape the filenames?,
> 2) is this a security issue or not?
My opinion is that it should escape the filenames as a matter of
correctness - otherwise, there are certain filenames which it could in
principle compile successfully, but which will not actually work - but
that it isn't a security issue.
As a general principle, if you're interpolating an arbitrary substring
(in this case a filename) into a string with a defined syntax (in this
case Bourne shell), and you don't specifically intend the substring to
be "code" in that syntax, then you should escape it appropriately for
that syntax. Failure to do so is certainly a correctness bug, and
sometimes a security flaw (depending on context).
(Incidentally, Geany is written using Gtk and GLib, and GLib already has
a function g_shell_quote() which escapes arbitrary filenames for /bin/sh.)
If shell syntax is not specifically needed, it would be even better to
use a mechanism not involving parsing shell syntax, like posix_spawn(),
GLib's g_spawn_async() or Python's os.spawn* family, to launch the
compiler (analogous to using prepared statements to avoid ever having to
think about SQL escaping or SQL injection).
> Obviously, even for gcc you can pass specially-crafted filename,
> when attempt to build it would lead to "ls -la" command (for example)
> to be executed.
What filenames would those be?
If Geany puts filenames in a shell command the way I suspect it does
from the "exploit" given, then a filename with a command in backticks,
e.g. foo`xmessage hello`.c, would be another "exploit" - but that's
entirely between Geany and the shell, and gcc would see only "foo.c".
(... and then fail because that file probably doesn't exist - another
reason to treat this as a correctness bug.)
S
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
