Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Event scope escape #733

Merged
merged 9 commits into from
Feb 8, 2017
Merged

Event scope escape #733

Changes from 2 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
eb6cd0b
add scope utils and k8s/docker events scope checks
aleks-f Jan 21, 2017
87f73e4
factor out scope check and assembly
aleks-f Jan 21, 2017
9e44c75
Merge branch 'dev' into event-scope-escape
aleks-f Jan 31, 2017
e340987
event scope class
aleks-f Feb 1, 2017
e52604c
Merge branch 'dev' into event-scope-escape
aleks-f Feb 2, 2017
59489f9
restrict key with regex, allow anything in value (e340987)
aleks-f Feb 2, 2017
ceb8cbc
replace c++11 regex with posix
aleks-f Feb 3, 2017
e909ae7
simplify regex check
aleks-f Feb 4, 2017
87e5bfd
fixes from @bertocci review
aleks-f Feb 8, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 17 additions & 31 deletions userspace/libsinsp/user_event.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ along with sysdig. If not, see <http://www.gnu.org/licenses/>.
#include "sinsp.h"
#include "sinsp_int.h"
#include "user_event.h"
#include <regex>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you tested on GCC 4.8? regex are not supported there.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

my centos6 machine got messed up, but yes it seems that they released it in 4.8 but it was buggy. I'll replace it with posix regex


//
// event_scope
Expand All @@ -31,9 +32,9 @@ const std::string event_scope::SCOPE_OP_AND = "and";
// and have their escaped counterparts in the REPLACEMENT_STRINGS,
// in the same order as they appear in RESERVED_STRINGS
const event_scope::string_list_t event_scope::RESERVED_STRINGS =
{"'"/*!must be first!*/, "=", " and ", " "};
{"'"};
const event_scope::string_list_t event_scope::REPLACEMENT_STRINGS =
{"\\'"/*!must be first!*/};
{"\\'"};

event_scope::event_scope(const std::string& key, const std::string& value)
{
Expand All @@ -60,51 +61,36 @@ bool event_scope::add(const std::string& key, const std::string& value, const st
}
else
{
g_logger.log("Scope key has invalid value: [" + key + "], not added to scope.", sinsp_logger::SEV_WARNING);
g_logger.log("Scope key is invalid: [" + key + "], entry will not be added to scope.",
sinsp_logger::SEV_WARNING);
}
return false;
}

string& event_scope::replace(std::string& value)
{
ASSERT(RESERVED_STRINGS.size() >= REPLACEMENT_STRINGS.size());
ASSERT(RESERVED_STRINGS.size() == REPLACEMENT_STRINGS.size());

if(check(value))
string_list_t::const_iterator res_it = RESERVED_STRINGS.cbegin();
string_list_t::const_iterator res_end = RESERVED_STRINGS.cend();
string_list_t::const_iterator rep_it = REPLACEMENT_STRINGS.cbegin();
string_list_t::const_iterator rep_end = REPLACEMENT_STRINGS.cend();
for(; res_it != res_end && rep_it != rep_end; ++res_it, ++rep_it)
{
trim(value);
string_list_t::const_iterator res_it = RESERVED_STRINGS.cbegin();
string_list_t::const_iterator res_end = RESERVED_STRINGS.cend();
string_list_t::const_iterator rep_it = REPLACEMENT_STRINGS.cbegin();
string_list_t::const_iterator rep_end = REPLACEMENT_STRINGS.cend();
for(; res_it != res_end && rep_it != rep_end; ++res_it)
{
replace_in_place(value, *res_it, *rep_it);
if(++rep_it == rep_end) { break; }
}
}
else
{
g_logger.log("Cannot replace invalid value: [" + value + "], string will be cleared.", sinsp_logger::SEV_WARNING);
value.clear();
replace_in_place(value, *res_it, *rep_it);
}

return value;
}

// utility function to check that scope entry is valid;
// valid entries can not contain '=' character or " and " string
bool event_scope::check(const std::string& scope)
{
if(scope.empty()) { return true; }
string_list_t::const_iterator rs = RESERVED_STRINGS.cbegin();
++rs;
for(; rs != RESERVED_STRINGS.end(); ++rs)
static const std::regex r("^[a-zA-Z0-9-_/\\.]*$");
if(std::regex_match(scope, r))
{
if(scope.find(*rs) != std::string::npos)
{
return false;
}
return true;
}
return true;
return false;
}


Expand Down