From 7f87a23bf3139ff15d92d9b9fcd29c6e84e66726 Mon Sep 17 00:00:00 2001 From: "http://www.cse.unsw.edu.au/~willu/" Date: Sun, 20 Jul 2008 18:02:10 -0400 Subject: --- doc/forum/perl5lib_and_wrappers.mdwn | 2 ++ 1 file changed, 2 insertions(+) (limited to 'doc/forum') diff --git a/doc/forum/perl5lib_and_wrappers.mdwn b/doc/forum/perl5lib_and_wrappers.mdwn index 01570963c..cf14848f2 100644 --- a/doc/forum/perl5lib_and_wrappers.mdwn +++ b/doc/forum/perl5lib_and_wrappers.mdwn @@ -7,3 +7,5 @@ I don't know if I'm doing this right... I'm using a server provider that doesn' > > The [[tips/nearlyfreespeech]] tip has an example of doing this. > --[[Joey]] + +>> Thanks! I found that page, but didn't recognise the importance of INSTALL_BASE. -- cgit v1.2.3 From a29b111afb09668098cf441aecf92306fb3f4b83 Mon Sep 17 00:00:00 2001 From: "http://www.cse.unsw.edu.au/~willu/" Date: Sun, 20 Jul 2008 18:17:20 -0400 Subject: reply --- doc/forum/Allow_overriding_of_symlink_restriction.mdwn | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) (limited to 'doc/forum') diff --git a/doc/forum/Allow_overriding_of_symlink_restriction.mdwn b/doc/forum/Allow_overriding_of_symlink_restriction.mdwn index eb86ef30f..f658f0cb3 100644 --- a/doc/forum/Allow_overriding_of_symlink_restriction.mdwn +++ b/doc/forum/Allow_overriding_of_symlink_restriction.mdwn @@ -15,6 +15,8 @@ The first appears to me to be less of a security issue. If there is a way for a > controlled directories could go down arbitrarily deep, down to the root of > the filesystem. --[[Joey]] +>> Fair point. + The current code seems to check this constraint at the top of IkiWiki/Render.pm at the start of refresh(). It seems to only check the source dir itself, not the subdirs. Then it uses File::Find to recuse which doesn't follow symlinks. Now my problem: I have a hosted server where I cannot avoid having a symlink in the source path. I've made a patch to optionally turn off the symlink checking in the source path itself. The patch would still not follow symlinks inside the source dir. This would seem to be ok security-wise for me as I know that path is ok and it isn't going to change on me. @@ -22,6 +24,8 @@ Now my problem: I have a hosted server where I cannot avoid having a symlink in > BTW, if you have a problem, please file it in [[todo]] or [[bugs]] in the > future. Especially if you also have a patch. :-) --[[Joey]] +>> Well, I was unsure I wasn't missing something. I wanted to discuss the concept of the patch as much as submit the patch. But, ok :) + Is there a huge objection to this patch? (note: patch inline - look at the source to get it. And I didn't re-indent the code when I added the if...) @@ -52,6 +56,8 @@ Is there a huge objection to this patch? > the `srcdir`. > --[[Joey]] +>> Ok, I'll try to get it cleaned up and documented. + There is a second location where this can be an issue. That is in the front of the wrapper. There the issue is that the path to the source dir as seen on the cgi server and on the git server are different - each has @@ -84,11 +90,17 @@ like this being accepted before I bothered. > ikiwiki uses absolute paths for `srcdir`, `destdir` and `this` because > the wrapper could be run from any location, and if any of them happen to > be a relative path, it would crash and burn. -> + +>> Which makes perfect sense. It is annoying that abs_path() is also +>> expanding symlinks. + > I think the thing to do might be to make it check if `srcdir` and > `destdir` look like an absolute path (ie, start with "/"). If so, it can > skip running `abs_path` on them. -> + +>> I'll do that. I assume something like File::Spec->file_name_is_absolute( $path ); would have more cross-platformy goodness. +>> hrm. I might see if File::Spec->rel2abs( $path ) ; will give absolute an path without expanding symlinks. + > I suppose you could do the same thing with `$this`, but it does not sound > like it has caused you problems anyway. > --[[Joey]] -- cgit v1.2.3 From 7337b86d13b9cbf73c745712a1f98f695afa45e6 Mon Sep 17 00:00:00 2001 From: "http://www.cse.unsw.edu.au/~willu/" Date: Mon, 21 Jul 2008 04:52:34 -0400 Subject: Update --- doc/forum/perl5lib_and_wrappers.mdwn | 2 ++ 1 file changed, 2 insertions(+) (limited to 'doc/forum') diff --git a/doc/forum/perl5lib_and_wrappers.mdwn b/doc/forum/perl5lib_and_wrappers.mdwn index cf14848f2..83efc7cb5 100644 --- a/doc/forum/perl5lib_and_wrappers.mdwn +++ b/doc/forum/perl5lib_and_wrappers.mdwn @@ -9,3 +9,5 @@ I don't know if I'm doing this right... I'm using a server provider that doesn' > --[[Joey]] >> Thanks! I found that page, but didn't recognise the importance of INSTALL_BASE. + +>> It looks like INSTALL_BASE only appeared in version 6.31 of the Perl MakeMaker. My provider is still running version 6.30. Looks like I'll be keeping my patches for the moment... sigh. -- cgit v1.2.3 From fb24242bb4868396211bd502e2f753294ec57947 Mon Sep 17 00:00:00 2001 From: "http://www.cse.unsw.edu.au/~willu/" Date: Mon, 21 Jul 2008 05:14:10 -0400 Subject: Updated patch --- .../Allow_overriding_of_symlink_restriction.mdwn | 43 +++++++++++++--------- 1 file changed, 25 insertions(+), 18 deletions(-) (limited to 'doc/forum') diff --git a/doc/forum/Allow_overriding_of_symlink_restriction.mdwn b/doc/forum/Allow_overriding_of_symlink_restriction.mdwn index f658f0cb3..0d93a28c1 100644 --- a/doc/forum/Allow_overriding_of_symlink_restriction.mdwn +++ b/doc/forum/Allow_overriding_of_symlink_restriction.mdwn @@ -68,24 +68,30 @@ patch fixes things. Again, patch inline. Again, this patch could be cleaned up :). I just wanted to see if there was any chance of a patch like this being accepted before I bothered. - diff --git a/IkiWiki/Wrapper.pm b/IkiWiki/Wrapper.pm - index 79b9eb3..e88118b 100644 - --- a/IkiWiki/Wrapper.pm - +++ b/IkiWiki/Wrapper.pm - @@ -9,9 +9,13 @@ use Data::Dumper; - use IkiWiki; - - sub gen_wrapper () { #{{{ - + my $this = $0; - + if ($config{allowsrcdirlinks}) { - + } else { - $config{srcdir}=abs_path($config{srcdir}); - $config{destdir}=abs_path($config{destdir}); - my $this=abs_path($0); - + } - if (! -x $this) { - error(sprintf(gettext("%s doesn't seem to be executable"), $this - } +>>> Patch updated: + + index 79b9eb3..ce1c395 100644 + --- a/IkiWiki/Wrapper.pm + +++ b/IkiWiki/Wrapper.pm + @@ -4,14 +4,14 @@ package IkiWiki; + + use warnings; + use strict; + -use Cwd q{abs_path}; + use Data::Dumper; + use IkiWiki; + +use File::Spec; + + sub gen_wrapper () { #{{{ + - $config{srcdir}=abs_path($config{srcdir}); + - $config{destdir}=abs_path($config{destdir}); + - my $this=abs_path($0); + + $config{srcdir}=File::Spec->rel2abs($config{srcdir}); + + $config{destdir}=File::Spec->rel2abs($config{destdir}); + + my $this=File::Spec->rel2abs($0); + if (! -x $this) { + error(sprintf(gettext("%s doesn't seem to be executable"), $this + } > ikiwiki uses absolute paths for `srcdir`, `destdir` and `this` because > the wrapper could be run from any location, and if any of them happen to @@ -100,6 +106,7 @@ like this being accepted before I bothered. >> I'll do that. I assume something like File::Spec->file_name_is_absolute( $path ); would have more cross-platformy goodness. >> hrm. I might see if File::Spec->rel2abs( $path ) ; will give absolute an path without expanding symlinks. +>>> Patch using rel2abs() works well - it no longer expands symlinks. > I suppose you could do the same thing with `$this`, but it does not sound > like it has caused you problems anyway. -- cgit v1.2.3 From 19d29f457639d045aa0a6f4e4766b9e96e9904d5 Mon Sep 17 00:00:00 2001 From: "http://www.cse.unsw.edu.au/~willu/" Date: Mon, 21 Jul 2008 06:05:46 -0400 Subject: Update patch --- .../Allow_overriding_of_symlink_restriction.mdwn | 64 +++++++++++++++------- 1 file changed, 44 insertions(+), 20 deletions(-) (limited to 'doc/forum') diff --git a/doc/forum/Allow_overriding_of_symlink_restriction.mdwn b/doc/forum/Allow_overriding_of_symlink_restriction.mdwn index 0d93a28c1..bd94811df 100644 --- a/doc/forum/Allow_overriding_of_symlink_restriction.mdwn +++ b/doc/forum/Allow_overriding_of_symlink_restriction.mdwn @@ -28,26 +28,50 @@ Now my problem: I have a hosted server where I cannot avoid having a symlink in Is there a huge objection to this patch? -(note: patch inline - look at the source to get it. And I didn't re-indent the code when I added the if...) - - index 990fcaa..d7cb37e 100644 - --- a/IkiWiki/Render.pm - +++ b/IkiWiki/Render.pm - @@ -260,6 +260,7 @@ sub prune ($) { #{{{ - - sub refresh () { #{{{ - # security check, avoid following symlinks in the srcdir path - + if (! $config{allowsrcdirlinks}) { - my $test=$config{srcdir}; - while (length $test) { - if (-l $test) { - @@ -269,6 +270,7 @@ sub refresh () { #{{{ - $test=dirname($test); - } - } - + } - - run_hooks(refresh => sub { shift->() }); +>>> [[patch]] updated. + + diff --git a/IkiWiki/Render.pm b/IkiWiki/Render.pm + index 990fcaa..0fb78ba 100644 + --- a/IkiWiki/Render.pm + +++ b/IkiWiki/Render.pm + @@ -260,13 +260,15 @@ sub prune ($) { #{{{ + + sub refresh () { #{{{ + # security check, avoid following symlinks in the srcdir path + - my $test=$config{srcdir}; + - while (length $test) { + - if (-l $test) { + - error("symlink found in srcdir path ($test)"); + - } + - unless ($test=~s/\/+$//) { + - $test=dirname($test); + + if (! $config{allow_insecure_symlinks_in_path_to_srcdir}) { + + my $test=$config{srcdir}; + + while (length $test) { + + if (-l $test) { + + error("symlink found in srcdir path ($test)"); + + } + + unless ($test=~s/\/+$//) { + + $test=dirname($test); + + } + } + } + + diff --git a/doc/ikiwiki.setup b/doc/ikiwiki.setup + index 10cb3da..eb86e49 100644 + --- a/doc/ikiwiki.setup + +++ b/doc/ikiwiki.setup + @@ -203,4 +203,10 @@ use IkiWiki::Setup::Standard { + # For use with the attachment plugin, a program that returns + # nonzero if its standard input contains an virus. + #virus_checker => "clamdscan -", + + + + # The following setting allows symlinks in the path to your + + # srcdir. Symlinks are still not followed within srcdir. + + # Allowing symlinks to be followed, even in the path to srcdir, + + # will make some setups insecure. + + #allow_insecure_symlinks_in_path_to_srcdir => 0, + } > No, I don't have a big objection to such an option, as long as it's > extremely well documented that it will make many setups insecure. -- cgit v1.2.3