From ca87bf766cdc70179cb2dce03015d78ec9c13ebd Mon Sep 17 00:00:00 2001 From: Toshi MARUYAMA Date: Thu, 7 Dec 2017 11:38:23 +0000 Subject: mercurial: reject malicious command argument (#27516) We've got a security report from the Phabricator team, which basically says --config and --debugger arguments can be injected anywhere to lead to an arbitrary command execution. https://secure.phabricator.com/rPa7921a4448093d00defa8bd18f35b8c8f8bf3314 This is a fundamental issue of the argument parsing rules in Mercurial, which allows extensions to populate their parsing rules and such extensions can be loaded by "--config extensions.=". There's a chicken and egg problem. We're working on hardening the parsing rules, but which won't come in by default as it would be a behavior change. This patch adds a verification to reject malicious command arguments as a last ditch. The subsequent patches will fix the problem in more appropriate way. Contributed by Yuya Nishihara. git-svn-id: http://svn.redmine.org/redmine/trunk@17060 e93f8b46-1217-0410-a6f0-8f06a7374b81 --- lib/redmine/scm/adapters/mercurial_adapter.rb | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'lib') diff --git a/lib/redmine/scm/adapters/mercurial_adapter.rb b/lib/redmine/scm/adapters/mercurial_adapter.rb index 064849f94..2c7121356 100644 --- a/lib/redmine/scm/adapters/mercurial_adapter.rb +++ b/lib/redmine/scm/adapters/mercurial_adapter.rb @@ -32,6 +32,8 @@ module Redmine # raised if hg command exited with error, e.g. unknown revision. class HgCommandAborted < CommandFailed; end + # raised if bad command argument detected before executing hg. + class HgCommandArgumentError < CommandFailed; end class << self def client_command @@ -286,8 +288,21 @@ module Redmine end end + # command options which may be processed earlier, by faulty parser in hg + HG_EARLY_BOOL_ARG = /^--(debugger|profile|traceback)$/ + HG_EARLY_LIST_ARG = /^(--(config|cwd|repo(sitory)?)\b|-R)/ + private_constant :HG_EARLY_BOOL_ARG, :HG_EARLY_LIST_ARG + # Runs 'hg' command with the given args def hg(*args, &block) + # as of hg 4.4.1, early parsing of bool options is not terminated at '--' + if args.any? { |s| s =~ HG_EARLY_BOOL_ARG } + raise HgCommandArgumentError, "malicious command argument detected" + end + if args.take_while { |s| s != '--' }.any? { |s| s =~ HG_EARLY_LIST_ARG } + raise HgCommandArgumentError, "malicious command argument detected" + end + repo_path = root_url || url full_args = ['-R', repo_path, '--encoding', 'utf-8'] full_args << '--config' << "extensions.redminehelper=#{HG_HELPER_EXT}" -- cgit v1.2.3