Skip to content
Permalink
Browse files Browse the repository at this point in the history
Fix a possible security issue
- Require manually set flag to run scripts from absolute pathname
- Mostly applies to scripts given on the command line
  • Loading branch information
gzotti committed Mar 4, 2023
1 parent eba61df commit 787a894
Show file tree
Hide file tree
Showing 2 changed files with 18 additions and 3 deletions.
2 changes: 2 additions & 0 deletions guide/app_config_ini.tex
Expand Up @@ -736,6 +736,8 @@ \subsection{\big[scripts\big]}
\begin{tabularx}{\textwidth}{l|l|l|X}\toprule
\emph{ID} & \emph{Type} & \emph{Default} & \emph{Description}\\\midrule
startup\_script & string & startup.ssc & name of script executed on program start\\
flag\_script\_allow\_absolute\_path & bool & false & set true to allow scripts from absolute pathnames.
This may pose a security risk if you run arbitrary scripts.\\
flag\_script\_allow\_write\_absolute\_path & bool & false & set true to let scripts store files to absolute pathnames.
This may pose a security risk if you run scripts from other authors
without checking what they are doing.\\\bottomrule
Expand Down
19 changes: 16 additions & 3 deletions src/scripting/StelScriptMgr.cpp
Expand Up @@ -794,8 +794,10 @@ bool StelScriptMgr::runPreprocessedScript(const QString &preprocessedScript, con
bool StelScriptMgr::runScript(const QString& fileName, const QString& includePath)
{
QString preprocessedScript;
prepareScript(preprocessedScript,fileName,includePath);
return runPreprocessedScript(preprocessedScript,fileName);
if (prepareScript(preprocessedScript,fileName,includePath))
return runPreprocessedScript(preprocessedScript,fileName);
else
return false;
}

bool StelScriptMgr::runScriptDirect(const QString scriptId, const QString &scriptCode, int &errLoc, const QString& includePath)
Expand All @@ -820,9 +822,20 @@ bool StelScriptMgr::runScriptDirect(const QString& scriptCode, const QString &in
bool StelScriptMgr::prepareScript( QString &script, const QString &fileName, const QString &includePath)
{
QString absPath;
const bool okToRunScriptFromAbsolutePath=StelApp::getInstance().getSettings()->value("scripts/flag_script_allow_absolute_path", false).toBool();

if (QFileInfo(fileName).isAbsolute())
absPath = fileName;
{
// Absolute paths may bear a security risk. We need a flag to allow them!
if (okToRunScriptFromAbsolutePath)
absPath = fileName;
else
{
qWarning() << "SCRIPTING CONFIGURATION ISSUE: You are trying to run a script from absolute pathname.";
qWarning() << " To enable this, edit config.ini and set [scripts]/flag_script_allow_absolute_path=true";
return false;
}
}
else
absPath = StelFileMgr::findFile("scripts/" + fileName);

Expand Down

0 comments on commit 787a894

Please sign in to comment.