1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
|
--- src/wzd_mod.c.orig 2005-09-26 09:34:42.000000000 +0200
+++ src/wzd_mod.c 2005-09-26 09:46:41.000000000 +0200
@@ -102,6 +102,7 @@
} protocol_handler_t;
static int _hook_print_file(const char *filename, wzd_context_t *context);
+void _cleanup_shell_command(char * buffer, size_t length);
static protocol_handler_t * proto_handler_list=NULL;
static unsigned int _reply_code;
@@ -378,6 +379,8 @@
{
*(buffer+l_command++) = ' ';
(void)wzd_strncpy(buffer + l_command, buffer_args, sizeof(buffer) - l_command - 1);
+ /* SECURITY filter buffer for shell special characters ! */
+ _cleanup_shell_command(buffer,sizeof(buffer));
if ( (command_output = popen(buffer,"r")) == NULL ) {
out_log(LEVEL_HIGH,"Hook '%s': unable to popen\n",hook->external_command);
return 1;
@@ -438,6 +441,8 @@
else
{
/* *(buffer+l_command++) = ' ';*/
+ /* SECURITY filter buffer for shell special characters ! */
+ _cleanup_shell_command(buffer,sizeof(buffer));
if ( (command_output = popen(buffer,"r")) == NULL ) {
out_log(LEVEL_HIGH,"Hook '%s': unable to popen\n",hook->external_command);
return 1;
@@ -733,6 +738,8 @@
}
+/*************** STATIC ****************/
+
static int _hook_print_file(const char *filename, wzd_context_t *context)
{
wzd_cache_t * fp;
@@ -765,3 +772,24 @@
return 0;
}
+
+void _cleanup_shell_command(char * buffer, size_t length)
+{
+ const char * specials = "$\\|;!`()'\"#.,:*?{}[]&<>-~";
+ size_t i,j;
+ char * buf2;
+
+ buf2 = wzd_malloc(length);
+
+ for (i=0,j=0; buffer[i]!='\0' && i<length && j<length; i++,j++) {
+ if (strchr(specials,buffer[i]) != NULL) {
+ if (j+1 >= length) { buf2[j]='\0'; break; }
+ buf2[j++] = '\\';
+ }
+ buf2[j] = buffer[i];
+ }
+
+ wzd_strncpy(buffer,buf2,length);
+ wzd_free(buf2);
+}
+
|
