Difuse/luci
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

libs/web: Added several sanity checks to avoid local privilege escalation

Browse source
This commit is contained in:
Steven Barth 2008-09-01 16:05:34 +00:00
parent c1edac6ed0
commit bb8137062f
2 changed files with 14 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
libs/web/luasrc/dispatcher.lua
View file

@ -263,6 +263,13 @@ function createindex_plain(path, suffix)
if indexcache then if indexcache then
local cachedate = fs.mtime(indexcache) local cachedate = fs.mtime(indexcache)
if cachedate and cachedate > fs.mtime(path) then if cachedate and cachedate > fs.mtime(path) then
assert(
sys.process.info("uid") == fs.stat(indexcache, "uid")
and fs.stat(indexcache, "mode") == "rw-------",
"Fatal: Indexcache is not sane!"
)
index = loadfile(indexcache)() index = loadfile(indexcache)()
return index return index
end end
@ -287,6 +294,7 @@ function createindex_plain(path, suffix)
if indexcache then if indexcache then
fs.writefile(indexcache, util.get_bytecode(index)) fs.writefile(indexcache, util.get_bytecode(index))
fs.chmod(indexcache, "a-rwx,u+rw")
end end
end end

10
libs/web/luasrc/sauth.lua
View file

@ -57,7 +57,7 @@ end
-- @param id Session identifier -- @param id Session identifier
-- @return Session data -- @return Session data
function read(id) function read(id)
if not id or not sane() then if not id or not sane(sessionpath .. "/" .. id) then
return return
end end
clean() clean()
@ -67,9 +67,11 @@ end
--- Check whether Session environment is sane. --- Check whether Session environment is sane.
-- @return Boolean status -- @return Boolean status
function sane() function sane(file)
return luci.sys.process.info("uid") == luci.fs.stat(sessionpath, "uid") return luci.sys.process.info("uid")
and luci.fs.stat(sessionpath, "mode") == "rwx------" == luci.fs.stat(file or sessionpath, "uid")
and luci.fs.stat(file or sessionpath, "mode")
== (file and "rw-------" or "rwx------")
end end