Skip to content
Permalink
Browse files Browse the repository at this point in the history
fix: [security] Sanitise paths for several file interactions
- remove :// anywhere we don't expect a protocol to be supplied
- remove phar:// in certauth plugin's fetcher

- as reported by Dawid Czarnecki of Zigrin Security
  • Loading branch information
iglocska committed Apr 17, 2022
1 parent 0108f1b commit 93821c0
Show file tree
Hide file tree
Showing 3 changed files with 256 additions and 252 deletions.
1 change: 1 addition & 0 deletions app/Model/AppModel.php
Expand Up @@ -2588,6 +2588,7 @@ public function getKafkaPubTool()
App::uses('KafkaPubTool', 'Tools');
$kafkaPubTool = new KafkaPubTool();
$rdkafkaIni = Configure::read('Plugin.Kafka_rdkafka_config');
$rdkafkaIni = mb_ereg_replace("/\:\/\//", '', $rdkafkaIni);
$kafkaConf = array();
if (!empty($rdkafkaIni)) {
$kafkaConf = parse_ini_file($rdkafkaIni);
Expand Down
6 changes: 4 additions & 2 deletions app/Model/Feed.php
Expand Up @@ -126,12 +126,13 @@ public function validateInputSource($fields)
public function urlOrExistingFilepath($fields)
{
if ($this->isFeedLocal($this->data)) {
$path = mb_ereg_replace("/\:\/\//", '', $this->data['Feed']['url']);
if ($this->data['Feed']['source_format'] == 'misp') {
if (!is_dir($this->data['Feed']['url'])) {
if (!is_dir($path)) {
return 'For MISP type local feeds, please specify the containing directory.';
}
} else {
if (!file_exists($this->data['Feed']['url'])) {
if (!file_exists($path)) {
return 'Invalid path or file not found. Make sure that the path points to an existing file that is readable and watch out for typos.';
}
}
Expand Down Expand Up @@ -1929,6 +1930,7 @@ private function downloadAndParseEventFromFeed($feed, $eventUuid, HttpSocket $Ht
private function feedGetUri($feed, $uri, HttpSocket $HttpSocket = null)
{
if ($this->isFeedLocal($feed)) {
$uri = mb_ereg_replace("/\:\/\//", '', $uri);
if (file_exists($uri)) {
return FileAccessTool::readFromFile($uri);
} else {
Expand Down

0 comments on commit 93821c0

Please sign in to comment.