Attachment 169171 Details for Bug 37323 – Bug 37323: Don't allow symlinks in link files in zip and validate filepaths

[patch] Bug 37323: Don't allow symlinks in link files in zip and validate filepaths

Bug-37323-Dont-allow-symlinks-in-link-files-in-zip.patch (text/plain), 1.71 KB, created by Chris Cormack on 2024-07-19 00:10:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Cormack

Created: 2024-07-19 00:10:36 UTC

Size: 1.71 KB

patch

obsolete

>From 074ec65a8d444adfa520eb38b01ac3044a7710d1 Mon Sep 17 00:00:00 2001
>From: Chris Cormack <chris@bigballofwax.co.nz>
>Date: Thu, 18 Jul 2024 23:57:32 +0000
>Subject: [PATCH] Bug 37323: Don't allow symlinks in link files in zip and
> validate filepaths
>
>Test plan:
>0. Apply patch and restart/reload Koha
>1. Test that uploading a patron image still works, in single file format and as a zip
>---
> tools/picture-upload.pl | 12 ++++++++----
> 1 file changed, 8 insertions(+), 4 deletions(-)
>
>diff --git a/tools/picture-upload.pl b/tools/picture-upload.pl
>index 4d6597fdee1..8e6a3bcc703 100755
>--- a/tools/picture-upload.pl
>+++ b/tools/picture-upload.pl
>@@ -25,6 +25,8 @@ use File::Temp;
> use CGI qw ( -utf8 );
> use GD;
> use MIME::Base64;
>+use Cwd;
>+
> use C4::Context;
> use C4::Auth qw( get_template_and_user );
> use C4::Output qw( output_and_exit output_html_with_http_headers );
>@@ -213,13 +215,15 @@ sub handle_dir {
>         my $dir_h;
>         opendir $dir_h, $dir;
>         while ( my $filename = readdir $dir_h ) {
>-            $file = "$dir/$filename"
>-              if ( $filename =~ m/datalink\.txt/i
>-                || $filename =~ m/idlink\.txt/i );
>+            
>+              if ( ($filename =~ m/datalink\.txt/i
>+                || $filename =~ m/idlink\.txt/i ) && ( -e "$dir/$filename" && !-l "$dir/$filename")) {
>+                  $file = Cwd::abs_path("$dir/$filename");
>+              }
>         }
>         my $fh;
>         unless ( open( $fh, '<', $file ) ) {
>-            warn "Opening $dir/$file failed!";
>+            warn "Opening $file failed!";
>             $direrrors{'OPNLINK'} = $file;
>             # This error is fatal to the import of this directory contents
>             # so bail and return the error to the caller
>-- 
>2.39.2

Actions: View | Diff | Splinter Review

Attachments on bug 37323: 168779 | 168856 | 168857 | 169170 | 169171 | 169175 | 169176 | 169637 | 169638 | 169639 | 169719 | 169720 | 169721