Skip to content
GitLab
Projects
Groups
Snippets
/
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
emulab
emulab-devel
Commits
7cbed49a
Commit
7cbed49a
authored
Feb 11, 2004
by
Leigh B. Stoller
Browse files
Tighter check on arguments since script is available from ops; make
sure filename is in one of allowed directories.
parent
b71c5010
Changes
1
Hide whitespace changes
Inline
Side-by-side
tbsetup/nscheck.in
View file @
7cbed49a
...
...
@@ -2,7 +2,7 @@
#
# EMULAB-COPYRIGHT
# Copyright (c) 2000-200
3
University of Utah and the Flux Group.
# Copyright (c) 2000-200
4
University of Utah and the Flux Group.
# All rights reserved.
#
...
...
@@ -61,19 +61,46 @@ my ($tempfile) = @ARGV;
# Untaint the arguments.
#
# Note different taint check (allow /).
if
(
$tempfile
=~
/^([-\
@\
w.\/]+)$/
)
{
if
(
$tempfile
=~
/^([-\w
\
.\/]+)$/
)
{
$tempfile
=
$
1
;
}
else
{
fatal
("
Tainted argument
$tempfile
");
}
#
# Called from ops interactively. Make sure NS file in /proj or /users.
#
# Use realpath to resolve any symlinks.
#
my
$translated
=
`
realpath
$tempfile
`;
if
(
$translated
=~
/^([-\w\.\/]+)$/
)
{
$tempfile
=
$
1
;
}
else
{
fatal
("
Tainted nsfile returned by realpath:
$translated
\n
");
}
#
# The file must reside in /proj, /groups, or /users. Since this script
# runs as the caller, regular file permission checks ensure its a file
# the user is allowed to use. /tmp/$guid-$nsref.nsfile also allowed
# since this script is invoked directly from web interface, which generates
# a name that should not be guessable, so as long as it looks to be in
# proper format, we accept it.
#
if
(
!
(
$tempfile
=~
/^\/tmp/
)
&&
!
(
$tempfile
=~
/^\/proj/
)
&&
!
(
$tempfile
=~
/^\/groups/
)
&&
!
(
$tempfile
=~
/^\/users/
))
{
fatal
("
$tempfile
does not resolve to an appropriate directory!
\n
");
}
$nsfile
=
"
foo.ns
";
# Check for existence of NS file and exit with error such that web
# interface tells the user (positive exit value).
if
(
!
-
f
$tempfile
||
!
-
r
$tempfile
)
{
if
(
!
-
f
$tempfile
||
!
-
r
$tempfile
||
-
z
$tempfile
)
{
print
STDERR
"
*** $0:
\n
"
.
"
$tempfile
does not exist or is not a readable file!
\n
";
exit
(
1
);
...
...
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment