Date: Thu, 13 Dec 2012 11:12:21 +0000 From: Simon McVittie <smcv@...ian.org> To: oss-security@...ts.openwall.com Subject: Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? On 12/12/12 16:51, Jan Lieskovsky wrote: > 1) should Geany escape the filenames?, > 2) is this a security issue or not? My opinion is that it should escape the filenames as a matter of correctness - otherwise, there are certain filenames which it could in principle compile successfully, but which will not actually work - but that it isn't a security issue. As a general principle, if you're interpolating an arbitrary substring (in this case a filename) into a string with a defined syntax (in this case Bourne shell), and you don't specifically intend the substring to be "code" in that syntax, then you should escape it appropriately for that syntax. Failure to do so is certainly a correctness bug, and sometimes a security flaw (depending on context). (Incidentally, Geany is written using Gtk and GLib, and GLib already has a function g_shell_quote() which escapes arbitrary filenames for /bin/sh.) If shell syntax is not specifically needed, it would be even better to use a mechanism not involving parsing shell syntax, like posix_spawn(), GLib's g_spawn_async() or Python's os.spawn* family, to launch the compiler (analogous to using prepared statements to avoid ever having to think about SQL escaping or SQL injection). > Obviously, even for gcc you can pass specially-crafted filename, > when attempt to build it would lead to "ls -la" command (for example) > to be executed. What filenames would those be? If Geany puts filenames in a shell command the way I suspect it does from the "exploit" given, then a filename with a command in backticks, e.g. foo`xmessage hello`.c, would be another "exploit" - but that's entirely between Geany and the shell, and gcc would see only "foo.c". (... and then fail because that file probably doesn't exist - another reason to treat this as a correctness bug.) S
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.