Pavel Kankovsky
23/12/02, 23:04
On Mon, 2 Dec 2002, Jay Beale wrote:
> This always gets classified as bad input validation. Is the right
> answer really to check for ../ 's or to canonicalize the filename
> argument and check ownerships and permissions on the file and parent
> directories?
#2 is wrong: even a root-only-writable file under root-only-writable
directories may be dangerous (e.g. a backup copy of an old and vulnerable
scheduler module). Moreover, its contents may be under the control of
other users even if the fs permission do not allow direct access (mail
queue, logs...--most of them should make it pretty difficult to create
a valid ELF object (logs) or should not appear on a properly configured
system (MTA running under root) but...)
#1 is much better assuming there is nothing but valid scheduler modules
in /kernel/sched et al (!). Nevertheless, one should always follow "the
principle of least inclusion" and check against a conservative set of
valid inputs (e.g. those matching [A-Z0-9_]{1,15}) rather than against a
set of known invalid or dangerous inputs (e.g. ../).
--Pavel Kankovsky aka Peak [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."
> This always gets classified as bad input validation. Is the right
> answer really to check for ../ 's or to canonicalize the filename
> argument and check ownerships and permissions on the file and parent
> directories?
#2 is wrong: even a root-only-writable file under root-only-writable
directories may be dangerous (e.g. a backup copy of an old and vulnerable
scheduler module). Moreover, its contents may be under the control of
other users even if the fs permission do not allow direct access (mail
queue, logs...--most of them should make it pretty difficult to create
a valid ELF object (logs) or should not appear on a properly configured
system (MTA running under root) but...)
#1 is much better assuming there is nothing but valid scheduler modules
in /kernel/sched et al (!). Nevertheless, one should always follow "the
principle of least inclusion" and check against a conservative set of
valid inputs (e.g. those matching [A-Z0-9_]{1,15}) rather than against a
set of known invalid or dangerous inputs (e.g. ../).
--Pavel Kankovsky aka Peak [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."