Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix CVE-2019-15597 - Implement new DF command instead of library function #7362

Merged
merged 1 commit into from
Jul 6, 2023

Conversation

nadavMiz
Copy link
Contributor

@nadavMiz nadavMiz commented Jun 27, 2023

Explain the changes

  1. implemented a local function to replace the unmaintained node-df library. this function is based on the node-df implementation with changes to fit our code better (https://github.com/adriano-di-giovanni/node-df).
  2. add '' before all special characters in the file name so bash will read them as part of the file name itself. this is to prevent the code injection suggested in CVE-2019-15597

Issues: Fixed #xxx / Gap #xxx

  1. https://bugzilla.redhat.com/show_bug.cgi?id=2124534

Testing Instructions:

  1. df is used mainly during node creation, so create a new backing store and validate that it was created successfully
  • Doc added/updated
  • Tests added

@nadavMiz nadavMiz requested review from nimrod-becker, a team and tangledbytes and removed request for a team June 27, 2023 11:02
@nimrod-becker nimrod-becker requested review from guymguym and removed request for nimrod-becker June 27, 2023 11:09
@nimrod-becker
Copy link
Contributor

lets add a unit test

src/util/os_utils.js Outdated Show resolved Hide resolved
src/util/os_utils.js Outdated Show resolved Hide resolved
@nadavMiz
Copy link
Contributor Author

lets add a unit test

since df checks the available space on the whole file system, which I have no control over, I can't test the validity of the actual values. so instead I just check that the command returns a valid response and that no errors are thrown

src/util/os_utils.js Outdated Show resolved Hide resolved
src/test/unit_tests/test_os_utils.js Outdated Show resolved Hide resolved
src/util/os_utils.js Outdated Show resolved Hide resolved
@nadavMiz
Copy link
Contributor Author

nadavMiz commented Jun 29, 2023

I have added try catch to df calls with file name since now the function throws if the file doesn't exist and does not just return a null value

src/util/os_utils.js Outdated Show resolved Hide resolved
src/util/os_utils.js Outdated Show resolved Hide resolved
src/util/os_utils.js Outdated Show resolved Hide resolved
Copy link
Contributor

@liranmauda liranmauda left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

…tion

Signed-off-by: nadav mizrahi <nadav.mizrahi16@gmail.com>
@nadavMiz nadavMiz merged commit bedfa56 into noobaa:master Jul 6, 2023
6 checks passed
@nadavMiz nadavMiz deleted the df-implement branch July 6, 2023 09:51
@nadavMiz nadavMiz restored the df-implement branch July 6, 2023 11:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants