Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MaxTurnIns Bypass Race Condition #16

Open
daknob opened this issue Sep 19, 2014 · 2 comments
Open

MaxTurnIns Bypass Race Condition #16

daknob opened this issue Sep 19, 2014 · 2 comments

Comments

@daknob
Copy link
Collaborator

daknob commented Sep 19, 2014

A bypass for the maxturnins argument on LIMITS file has been found possible under certain conditions.
More specifically, a user that has initiated a turnin that is legal in terms of quota can finalise the submission even if the course changes the maxturnins during the process of submission.
Steps to reproduce:

  1. Run turnin assignment@course file.c as user and finalise the turn in
  2. Run turnin assignment@course file.c as user and wait before pressing the final y.
  3. Run echo "maxturnins 1" > ~/TURNIN/assignment/LIMITSas course.
  4. Press y as user on the second turnin.

Abuse of this race condition is detectable through the LOGFILE and SHA256 since it marks the submission sequentially, even if it's over the maximum allowed limit.

@daknob
Copy link
Collaborator Author

daknob commented Sep 19, 2014

DaKnOb added dofixitlazydev label

@daknob
Copy link
Collaborator Author

daknob commented Sep 19, 2014

It has been discovered that the same issue exists with maxfiles, maxkbytes and binary as well.

@zakkak zakkak removed the bug label Sep 19, 2014
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants