diff options
| author | kwm <kwm@FreeBSD.org> | 2011-07-29 03:20:07 +0800 |
|---|---|---|
| committer | kwm <kwm@FreeBSD.org> | 2011-07-29 03:20:07 +0800 |
| commit | 1b41c8510e9ead6be7183fb53ff3437d424af7f8 (patch) | |
| tree | 00df0264d86e5cf741c16d766cdbeee77b6a46eb | |
| parent | 1cb341b3383f362933f25666ed5793db50543e03 (diff) | |
| download | freebsd-ports-gnome-1b41c8510e9ead6be7183fb53ff3437d424af7f8.tar.gz freebsd-ports-gnome-1b41c8510e9ead6be7183fb53ff3437d424af7f8.tar.zst freebsd-ports-gnome-1b41c8510e9ead6be7183fb53ff3437d424af7f8.zip | |
Fix a security hole that caused some SoupServer users to unintentionally
allow accessing the entire local filesystem when they thought they were only
providing access to a single directory.
Security: 30cb4522-b94d-11e0-8182-485d60cb5385
| -rw-r--r-- | devel/libsoup/Makefile | 2 | ||||
| -rw-r--r-- | devel/libsoup/files/patch-libsoup_soup-server.c | 34 |
2 files changed, 35 insertions, 1 deletions
diff --git a/devel/libsoup/Makefile b/devel/libsoup/Makefile index 7053e556545b..4e47a12161c8 100644 --- a/devel/libsoup/Makefile +++ b/devel/libsoup/Makefile @@ -8,7 +8,7 @@ PORTNAME= libsoup PORTVERSION= 2.32.2 -PORTREVISION?= 2 +PORTREVISION?= 3 CATEGORIES= devel gnome MASTER_SITES= GNOME DIST_SUBDIR= gnome2 diff --git a/devel/libsoup/files/patch-libsoup_soup-server.c b/devel/libsoup/files/patch-libsoup_soup-server.c new file mode 100644 index 000000000000..93116ad065a3 --- /dev/null +++ b/devel/libsoup/files/patch-libsoup_soup-server.c @@ -0,0 +1,34 @@ +From 51eb8798c3965b49f3010db82009d36429f28514 Mon Sep 17 00:00:00 2001 +From: Dan Winship <danw@gnome.org> +Date: Wed, 29 Jun 2011 14:04:06 +0000 +Subject: SoupServer: fix to not allow smuggling ".." into path + +When SoupServer:raw-paths was set (the default), it was possible to +sneak ".." segments into the path passed to the SoupServerHandler, +which could then end up tricking some handlers into retrieving +arbitrary files from the filesystem. Fix that. + +https://bugzilla.gnome.org/show_bug.cgi?id=653258 +--- +diff --git a/libsoup/soup-server.c b/libsoup/soup-server.c +index d56efd1..7225337 100644 +--- libsoup/soup-server.c ++++ libsoup/soup-server.c +@@ -779,6 +779,15 @@ got_headers (SoupMessage *req, SoupClientContext *client) + + uri = soup_message_get_uri (req); + decoded_path = soup_uri_decode (uri->path); ++ ++ if (strstr (decoded_path, "/../") || ++ g_str_has_suffix (decoded_path, "/..")) { ++ /* Introducing new ".." segments is not allowed */ ++ g_free (decoded_path); ++ soup_message_set_status (req, SOUP_STATUS_BAD_REQUEST); ++ return; ++ } ++ + soup_uri_set_path (uri, decoded_path); + g_free (decoded_path); + } +-- +cgit v0.9 |