Re: pre-announce exmh-2.7.2

On Tue, 04 Jan 2005 22:07:32 PST, Brent Welch said:

>  > 1) In MimeStripPart, it probably needs to do some regexp magic to
>  > sanitize the $filename, similar to what I added to the Save... dialog
>  > code.
> 
> How about
>     set path [file tail $path]
>     set path [string trim $path]
>     if {[regexp {^\|} $path]} {
>       catch {puts stderr "Bad filename $path"}
>       exit 1
>     }

Insufficient.  You aren't preventing ../../../hi-there-Brent attacks.  I ended
up doing this in lib/fileselect.tcl:

    # Smash out anything that isn't alphanumeric, period, underscore or dash
    regsub -all {[^[:print:]._-]+} $defaultName _ defaultName
    # Oh, and too many things treat dot-files as special...
    regsub {^\.+} $defaultName _ defaultName

And even there, I suspect that [:print:] can be abused in some non-ascii
locales...

Consider what happens if you get handed something like:

    filename="foo;echo 'hibrent::0:0::::' >> /etc/passwd;baz"

You may create the file with that name securely, but you're just setting the
user up for a surprise if later there's a 'find | xargs' or something else
that doesn't handle globbing quite right....

_______________________________________________
Exmh-workers mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/exmh-workers

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFB24mwcC3lWbTT17ARAn9JAJ4sjI8ZI+TyhCLxtxE0XpXuRxmWDACgjWoC
v+momQxAihYM3VumRih7CnQ=
=p7yW
-----END PGP SIGNATURE-----