diff options
| author | Amar Tumballi <amarts@redhat.com> | 2018-08-09 13:00:01 +0530 |
|---|---|---|
| committer | Amar Tumballi <amarts@redhat.com> | 2018-09-05 09:23:26 +0000 |
| commit | 9ae986f18c0f251cba6bbc23eae2150a8ce0417e (patch) | |
| tree | f490a0aaa2bde0bfc954abd57570125d206ec148 | |
| parent | cc3271ebf3aacdbbc77fdd527375af78ab12ea8d (diff) | |
server-protocol: don't allow '../' path in 'name'
This will prevent any arbitrary file creation through glusterfs
by modifying the client bits.
Also check for the similar flaw inside posix too, so we prevent any
changes in layers in-between.
Fixes: bz#1625095
Signed-off-by: Amar Tumballi <amarts@redhat.com>
Change-Id: Id9fe0ef6e86459e8ed85ab947d977f058c5ae06e
| -rw-r--r-- | xlators/protocol/server/src/server-resolve.c | 12 | ||||
| -rw-r--r-- | xlators/storage/posix/src/posix-handle.h | 6 |
2 files changed, 18 insertions, 0 deletions
diff --git a/xlators/protocol/server/src/server-resolve.c b/xlators/protocol/server/src/server-resolve.c index 6ffb9098421..b3eda0e4c9e 100644 --- a/xlators/protocol/server/src/server-resolve.c +++ b/xlators/protocol/server/src/server-resolve.c @@ -311,6 +311,18 @@ resolve_entry_simple (call_frame_t *frame) /* expected @parent was found from the inode cache */ gf_uuid_copy (state->loc_now->pargfid, resolve->pargfid); state->loc_now->parent = inode_ref (parent); + + if (strstr (resolve->bname, "../")) { + /* Resolving outside the parent's tree is not allowed */ + gf_msg (this->name, GF_LOG_ERROR, EPERM, + PS_MSG_GFID_RESOLVE_FAILED, + "%s: path sent by client not allowed", + resolve->bname); + resolve->op_ret = -1; + resolve->op_errno = EPERM; + ret = 1; + goto out; + } state->loc_now->name = resolve->bname; inode = inode_grep (state->itable, parent, resolve->bname); diff --git a/xlators/storage/posix/src/posix-handle.h b/xlators/storage/posix/src/posix-handle.h index b12e8b9610c..621f8f4d450 100644 --- a/xlators/storage/posix/src/posix-handle.h +++ b/xlators/storage/posix/src/posix-handle.h @@ -142,6 +142,12 @@ break; \ } \ \ + if (strstr (loc->name, "../")) { \ + gf_msg (this->name, GF_LOG_ERROR, 0, P_MSG_ENTRY_HANDLE_CREATE, \ + "'../' in name not allowed: (%s)", loc->name); \ + op_ret = -1; \ + break; \ + } \ if (LOC_HAS_ABSPATH (loc)) { \ MAKE_REAL_PATH (entp, this, loc->path); \ __parp = strdupa (entp); \ |