oss-sec mailing list archives
Re: Geany IDE not escaping filenames during compilation / build - a security issue or not?
From: Simon McVittie <smcv () debian org>
Date: Thu, 13 Dec 2012 11:12:21 +0000
On 12/12/12 16:51, Jan Lieskovsky wrote:
1) should Geany escape the filenames?, 2) is this a security issue or not?
My opinion is that it should escape the filenames as a matter of correctness - otherwise, there are certain filenames which it could in principle compile successfully, but which will not actually work - but that it isn't a security issue. As a general principle, if you're interpolating an arbitrary substring (in this case a filename) into a string with a defined syntax (in this case Bourne shell), and you don't specifically intend the substring to be "code" in that syntax, then you should escape it appropriately for that syntax. Failure to do so is certainly a correctness bug, and sometimes a security flaw (depending on context). (Incidentally, Geany is written using Gtk and GLib, and GLib already has a function g_shell_quote() which escapes arbitrary filenames for /bin/sh.) If shell syntax is not specifically needed, it would be even better to use a mechanism not involving parsing shell syntax, like posix_spawn(), GLib's g_spawn_async() or Python's os.spawn* family, to launch the compiler (analogous to using prepared statements to avoid ever having to think about SQL escaping or SQL injection).
Obviously, even for gcc you can pass specially-crafted filename, when attempt to build it would lead to "ls -la" command (for example) to be executed.
What filenames would those be? If Geany puts filenames in a shell command the way I suspect it does from the "exploit" given, then a filename with a command in backticks, e.g. foo`xmessage hello`.c, would be another "exploit" - but that's entirely between Geany and the shell, and gcc would see only "foo.c". (... and then fail because that file probably doesn't exist - another reason to treat this as a correctness bug.) S
Current thread:
- Geany IDE not escaping filenames during compilation / build - a security issue or not? Jan Lieskovsky (Dec 12)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Frank Lanitz (Dec 12)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Eitan Adler (Dec 12)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Andreas Ericsson (Dec 13)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Jan Lieskovsky (Dec 13)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Simon McVittie (Dec 13)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Andreas Ericsson (Dec 13)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Colomban Wendling (Dec 13)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Andreas Ericsson (Dec 13)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Matthew Brush (Dec 13)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Andreas Ericsson (Dec 13)