From ddf70a3e70da9a133e3126d889bbb9bbe5496bda Mon Sep 17 00:00:00 2001 From: Koop Mast Date: Thu, 28 Jul 2011 19:20:07 +0000 Subject: [PATCH] Fix a security hole that caused some SoupServer users to unintentionally allow accessing the entire local filesystem when they thought they were only providing access to a single directory. Security: 30cb4522-b94d-11e0-8182-485d60cb5385 --- devel/libsoup/Makefile | 2 +- .../libsoup/files/patch-libsoup_soup-server.c | 34 +++++++++++++++++++ 2 files changed, 35 insertions(+), 1 deletion(-) create mode 100644 devel/libsoup/files/patch-libsoup_soup-server.c diff --git a/devel/libsoup/Makefile b/devel/libsoup/Makefile index 7053e556545b..4e47a12161c8 100644 --- a/devel/libsoup/Makefile +++ b/devel/libsoup/Makefile @@ -8,7 +8,7 @@ PORTNAME= libsoup PORTVERSION= 2.32.2 -PORTREVISION?= 2 +PORTREVISION?= 3 CATEGORIES= devel gnome MASTER_SITES= GNOME DIST_SUBDIR= gnome2 diff --git a/devel/libsoup/files/patch-libsoup_soup-server.c b/devel/libsoup/files/patch-libsoup_soup-server.c new file mode 100644 index 000000000000..93116ad065a3 --- /dev/null +++ b/devel/libsoup/files/patch-libsoup_soup-server.c @@ -0,0 +1,34 @@ +From 51eb8798c3965b49f3010db82009d36429f28514 Mon Sep 17 00:00:00 2001 +From: Dan Winship +Date: Wed, 29 Jun 2011 14:04:06 +0000 +Subject: SoupServer: fix to not allow smuggling ".." into path + +When SoupServer:raw-paths was set (the default), it was possible to +sneak ".." segments into the path passed to the SoupServerHandler, +which could then end up tricking some handlers into retrieving +arbitrary files from the filesystem. Fix that. + +https://bugzilla.gnome.org/show_bug.cgi?id=653258 +--- +diff --git a/libsoup/soup-server.c b/libsoup/soup-server.c +index d56efd1..7225337 100644 +--- libsoup/soup-server.c ++++ libsoup/soup-server.c +@@ -779,6 +779,15 @@ got_headers (SoupMessage *req, SoupClientContext *client) + + uri = soup_message_get_uri (req); + decoded_path = soup_uri_decode (uri->path); ++ ++ if (strstr (decoded_path, "/../") || ++ g_str_has_suffix (decoded_path, "/..")) { ++ /* Introducing new ".." segments is not allowed */ ++ g_free (decoded_path); ++ soup_message_set_status (req, SOUP_STATUS_BAD_REQUEST); ++ return; ++ } ++ + soup_uri_set_path (uri, decoded_path); + g_free (decoded_path); + } +-- +cgit v0.9