Re: pre-announce exmh-2.7.2

file tail protects against filenames with any leading components.

set filename "foo;echo 'hibrent::0:0::::' >> /etc/passwd;baz"

file tail $filename
=> passwd;baz

>>>[email protected] said:
 > On Tue, 04 Jan 2005 22:07:32 PST, Brent Welch said:
 > 
 > >  > 1) In MimeStripPart, it probably needs to do some regexp magic to
 > >  > sanitize the $filename, similar to what I added to the Save...
 > dialog
 > >  > code.
 > > 
 > > How about
 > >     set path [file tail $path]
 > >     set path [string trim $path]
 > >     if {[regexp {^\|} $path]} {
 > >       catch {puts stderr "Bad filename $path"}
 > >       exit 1
 > >     }
 > 
 > Insufficient.  You aren't preventing ../../../hi-there-Brent attacks.  I
 > ended
 > up doing this in lib/fileselect.tcl:
 > 
 >     # Smash out anything that isn't alphanumeric, period, underscore or
 > dash
 >     regsub -all {[^[:print:]._-]+} $defaultName _ defaultName
 >     # Oh, and too many things treat dot-files as special...
 >     regsub {^\.+} $defaultName _ defaultName
 > 
 > And even there, I suspect that [:print:] can be abused in some non-ascii
 > locales...
 > 
 > Consider what happens if you get handed something like:
 > 
 >     filename="foo;echo 'hibrent::0:0::::' >> /etc/passwd;baz"
 > 
 > You may create the file with that name securely, but you're just setting
 > the
 > user up for a surprise if later there's a 'find | xargs' or something
 > else
 > that doesn't handle globbing quite right....
 > 

--
Brent Welch
Software Architect, Panasas Inc
Delivering the premier storage system for scalable Linux clusters

www.panasas.com
[email protected]