Nmap Development mailing list archives
Re: [NSE] Adding mkdir support
From: Patrick Donnelly <batrick () batbytes com>
Date: Wed, 4 Apr 2012 17:13:46 -0400
On Wed, Apr 4, 2012 at 3:55 PM, Djalal Harouni <tixxdz () opendz org> wrote:
Hi Patrik, On Sat, Mar 31, 2012 at 10:20:09PM +0200, Patrik Karlsson wrote:Hi Djalal, Your comment got me thinking and while working on the luadoc documentation I went through all of the functionality the fs library provides. To be honest, I don't think it should be a problem including any of the functions.Ok, I took a quick look, and I think that we should modify the following: make_dir() function calls mkdir() in this way: mkdir (path, S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IWGRP | S_IXGRP | S_IROTH | S_IXOTH ); ^^^^^^^ At least we should use 0755 regardless of the current value of umask and avoid situations where groups are shared... Other solutions: 1) use 0700 mode ? (I like this one). 2) add an extra argument to control the mode ? David, Patrick what do you think ? should we report this upstream ?
I believe the reason they don't support a mode argument for mkdir is because it's not supported for Windows. In any case, I agree that 0700 is the correct mode. It should be reported upstream.
BTW while we are at this thing, IMHO we should add checks to only write to directories owned by the current user and writable only by the current user, and try to avoid issues that can raise from following crafted urls and links from servers. Perhaps we should define something like "/" root directory and write all the stuff there in case...
I really think we should avoid modifying lfs as much as possible. The main reason I encouraged using lfs is because it is fairly standard in the community and mostly portable.
something searching for this when new code is committed as an additional check maybe?That would be nice, a simple script that evaluates or identifies Lua functions will help. This can be a simple and nice GSoC task.
This is non-trivial. It is quite easy to have Lua code reference something like os.execute without actually being obvious (from a code analysis standpoint) about it: local os = require "os" os[string.gsub("dwdbtsd", ".", function(a) return string.char(string.byte(a)+1) end)]("echo hi") Of course that's suspicious code but you get the idea. The only safe thing to do is remove os.execute which is not something we've wanted to do in the past. I also use the term "safe" cautiously. I don't think we can ever truly protect against malicious scripts without seriously hamstringing the available freedoms scripts currently enjoy. -- - Patrick Donnelly _______________________________________________ Sent through the nmap-dev mailing list http://cgi.insecure.org/mailman/listinfo/nmap-dev Archived at http://seclists.org/nmap-dev/
Current thread:
- Re: [NSE] Adding mkdir support Patrick Donnelly (Apr 02)
- <Possible follow-ups>
- Re: [NSE] Adding mkdir support Fyodor (Apr 04)
- Re: [NSE] Adding mkdir support Djalal Harouni (Apr 04)
- Re: [NSE] Adding mkdir support Patrick Donnelly (Apr 04)
- Re: [NSE] Adding mkdir support Djalal Harouni (Apr 04)
- Re: [NSE] Adding mkdir support David Fifield (Apr 05)
- Re: [NSE] Adding mkdir support Patrick Donnelly (Apr 04)