[PATCH] sftp: avoid re-parsing server-controlled path in cd fallback

------=_Part_1549_1070269234.1783855535219
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

Dear OpenSSH developers,

the attached patch fixes the sibling of the issue just fixed in commit
1b39f39657 ("avoid download to server-controlled path when performing
download on the commandline"). That commit fixed the file-download case
by calling process_get() directly instead of building and re-parsing a
"get ..." command string. The directory case (`sftp host:dir`) still
builds a "cd \"%s\"" string from the server's realpath response and
re-parses it, which a realpath containing a double quote breaks,
aborting the client with "Unterminated quoted argument".

This patch resolves and validates the target directory directly instead,
mirroring the existing I_CHDIR case.

Unlike the file-download case, this isn't a security report. A crafted
realpath can inject extra tokens into the re-parsed "cd" command, but
I_CHDIR only reads the first one, so nothing injected is ever acted on.
Worst case is the client aborting with a confusing error, not a
redirected write.

Manfred Kaiser
------=_Part_1549_1070269234.1783855535219
Content-Type: text/x-patch; charset=UTF-8;
 name=0001-sftp-avoid-re-parsing-server-controlled-path-in-cd-f.patch
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename=0001-sftp-avoid-re-parsing-server-controlled-path-in-cd-f.patch
X-Part-Id: 35b8360805b841418261876b231cb51f

RnJvbSA1MDM5NTgyYTgwNWFlODU5YjgzMGZhZGQyN2UzZmM1ODllZTA3MzdiIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBNYW5mcmVkIEthaXNlciA8bWFuZnJlZC5rYWlzZXJAc3NoLW1p
dG0uYXQ+CkRhdGU6IFN1biwgMTIgSnVsIDIwMjYgMTI6MzQ6NTQgKzAyMDAKU3ViamVjdDogW1BB
VENIXSBzZnRwOiBhdm9pZCByZS1wYXJzaW5nIHNlcnZlci1jb250cm9sbGVkIHBhdGggaW4gY2Qg
ZmFsbGJhY2sKCmludGVyYWN0aXZlX2xvb3AoKSdzIGRpcmVjdG9yeS1kb3dubG9hZCBjYXNlIGJ1
aWx0IGEgImNkIFwiJXNcIiIgc3RyaW5nCmZyb20gdGhlIHNlcnZlcidzIHJlYWxwYXRoIHJlc3Bv
bnNlIGFuZCByZS1wYXJzZWQgaXQsIHRoZSBzYW1lIHBhdHRlcm4KanVzdCBmaXhlZCBmb3IgdGhl
IGZpbGUtZG93bmxvYWQgY2FzZSBpbiAxYjM5ZjM5NjU3LiBBIHJlYWxwYXRoCmNvbnRhaW5pbmcg
YSBkb3VibGUgcXVvdGUgYnJlYWtzIHRoZSBwYXJzZXIsIGFib3J0aW5nIHRoZSBjbGllbnQuCgpF
eHRyYWN0IHRoZSBleGlzdGluZyBJX0NIRElSIGxvZ2ljIGludG8gcHJvY2Vzc19jaGRpcigpIGFu
ZCBjYWxsIGl0CmRpcmVjdGx5IGZyb20gYm90aCBwbGFjZXMsIGF2b2lkaW5nIHRoZSBzdHJpbmcg
cm91bmQtdHJpcCBlbnRpcmVseS4KLS0tCiBzZnRwLmMgfCA3MCArKysrKysrKysrKysrKysrKysr
KysrKysrKysrKysrKysrLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCiAxIGZpbGUgY2hhbmdlZCwg
NDEgaW5zZXJ0aW9ucygrKSwgMjkgZGVsZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEvc2Z0cC5jIGIv
c2Z0cC5jCmluZGV4IDMxZDhmYTQ5NC4uYmQ4ODAwYTM3IDEwMDY0NAotLS0gYS9zZnRwLmMKKysr
IGIvc2Z0cC5jCkBAIC0xNTUyLDYgKzE1NTIsNDQgQEAgcGFyc2VfYXJncyhjb25zdCBjaGFyICoq
Y3BwLCBpbnQgKmlnbm9yZV9lcnJvcnMsIGludCAqZGlzYWJsZV9lY2hvLCBpbnQgKmFmbGFnLAog
CXJldHVybihjbWRudW0pOwogfQogCisvKgorICogUmVzb2x2ZSAqcGF0aDEgKGRlZmF1bHRpbmcg
dG8gc3RhcnRkaXIgaWYgZW1wdHkpIHRvIGFuIGFic29sdXRlLCB2ZXJpZmllZAorICogZGlyZWN0
b3J5IG9uIHRoZSBzZXJ2ZXIgYW5kIHVwZGF0ZSAqcHdkIHRvIGl0LiAqcGF0aDEgaXMgdXBkYXRl
ZCBpbiBwbGFjZQorICogdmlhIHNmdHBfbWFrZV9hYnNvbHV0ZSgpIHNvIHRoZSBjYWxsZXIncyBu
b3JtYWwgY2xlYW51cCBvZiBpdCBzdGlsbAorICogYXBwbGllcy4gUmV0dXJucyAwIG9uIHN1Y2Nl
c3MsIC0xIG9uIGVycm9yIChoYXZpbmcgYWxyZWFkeSBjYWxsZWQgZXJyb3IoKQorICogaWYgYXBw
cm9wcmlhdGUpLgorICovCitzdGF0aWMgaW50Citwcm9jZXNzX2NoZGlyKHN0cnVjdCBzZnRwX2Nv
bm4gKmNvbm4sIGNoYXIgKipwYXRoMSwgY2hhciAqKnB3ZCwKKyAgICBjb25zdCBjaGFyICpzdGFy
dGRpcikKK3sKKwljaGFyICp0bXA7CisJQXR0cmliIGFhOworCisJaWYgKCpwYXRoMSA9PSBOVUxM
IHx8ICoqcGF0aDEgPT0gJ1wwJykKKwkJKnBhdGgxID0geHN0cmR1cChzdGFydGRpcik7CisJKnBh
dGgxID0gc2Z0cF9tYWtlX2Fic29sdXRlKCpwYXRoMSwgKnB3ZCk7CisJaWYgKCh0bXAgPSBzZnRw
X3JlYWxwYXRoKGNvbm4sICpwYXRoMSkpID09IE5VTEwpCisJCXJldHVybiAtMTsKKwlpZiAoc2Z0
cF9zdGF0KGNvbm4sIHRtcCwgMCwgJmFhKSAhPSAwKSB7CisJCWZyZWUodG1wKTsKKwkJcmV0dXJu
IC0xOworCX0KKwlpZiAoIShhYS5mbGFncyAmIFNTSDJfRklMRVhGRVJfQVRUUl9QRVJNSVNTSU9O
UykpIHsKKwkJZXJyb3IoIkNhbid0IGNoYW5nZSBkaXJlY3Rvcnk6IENhbid0IGNoZWNrIHRhcmdl
dCIpOworCQlmcmVlKHRtcCk7CisJCXJldHVybiAtMTsKKwl9CisJaWYgKCFTX0lTRElSKGFhLnBl
cm0pKSB7CisJCWVycm9yKCJDYW4ndCBjaGFuZ2UgZGlyZWN0b3J5OiBcIiVzXCIgaXMgbm90IGEg
ZGlyZWN0b3J5IiwgdG1wKTsKKwkJZnJlZSh0bXApOworCQlyZXR1cm4gLTE7CisJfQorCWZyZWUo
KnB3ZCk7CisJKnB3ZCA9IHRtcDsKKwlyZXR1cm4gMDsKK30KKwogc3RhdGljIGludAogcGFyc2Vf
ZGlzcGF0Y2hfY29tbWFuZChzdHJ1Y3Qgc2Z0cF9jb25uICpjb25uLCBjb25zdCBjaGFyICpjbWQs
IGNoYXIgKipwd2QsCiAgICAgY29uc3QgY2hhciAqc3RhcnRkaXIsIGludCBlcnJfYWJvcnQsIGlu
dCBlY2hvX2NvbW1hbmQpCkBAIC0xNjQ2LDMzICsxNjg0LDggQEAgcGFyc2VfZGlzcGF0Y2hfY29t
bWFuZChzdHJ1Y3Qgc2Z0cF9jb25uICpjb25uLCBjb25zdCBjaGFyICpjbWQsIGNoYXIgKipwd2Qs
CiAJCWVyciA9IHNmdHBfcm1kaXIoY29ubiwgcGF0aDEpOwogCQlicmVhazsKIAljYXNlIElfQ0hE
SVI6Ci0JCWlmIChwYXRoMSA9PSBOVUxMIHx8ICpwYXRoMSA9PSAnXDAnKQotCQkJcGF0aDEgPSB4
c3RyZHVwKHN0YXJ0ZGlyKTsKLQkJcGF0aDEgPSBzZnRwX21ha2VfYWJzb2x1dGUocGF0aDEsICpw
d2QpOwotCQlpZiAoKHRtcCA9IHNmdHBfcmVhbHBhdGgoY29ubiwgcGF0aDEpKSA9PSBOVUxMKSB7
CisJCWlmIChwcm9jZXNzX2NoZGlyKGNvbm4sICZwYXRoMSwgcHdkLCBzdGFydGRpcikgIT0gMCkK
IAkJCWVyciA9IDE7Ci0JCQlicmVhazsKLQkJfQotCQlpZiAoc2Z0cF9zdGF0KGNvbm4sIHRtcCwg
MCwgJmFhKSAhPSAwKSB7Ci0JCQlmcmVlKHRtcCk7Ci0JCQllcnIgPSAxOwotCQkJYnJlYWs7Ci0J
CX0KLQkJaWYgKCEoYWEuZmxhZ3MgJiBTU0gyX0ZJTEVYRkVSX0FUVFJfUEVSTUlTU0lPTlMpKSB7
Ci0JCQllcnJvcigiQ2FuJ3QgY2hhbmdlIGRpcmVjdG9yeTogQ2FuJ3QgY2hlY2sgdGFyZ2V0Iik7
Ci0JCQlmcmVlKHRtcCk7Ci0JCQllcnIgPSAxOwotCQkJYnJlYWs7Ci0JCX0KLQkJaWYgKCFTX0lT
RElSKGFhLnBlcm0pKSB7Ci0JCQllcnJvcigiQ2FuJ3QgY2hhbmdlIGRpcmVjdG9yeTogXCIlc1wi
IGlzIG5vdCAiCi0JCQkgICAgImEgZGlyZWN0b3J5IiwgdG1wKTsKLQkJCWZyZWUodG1wKTsKLQkJ
CWVyciA9IDE7Ci0JCQlicmVhazsKLQkJfQotCQlmcmVlKCpwd2QpOwotCQkqcHdkID0gdG1wOwog
CQlicmVhazsKIAljYXNlIElfTFM6CiAJCWlmICghcGF0aDEpIHsKQEAgLTIyODYsOSArMjI5OSw4
IEBAIGludGVyYWN0aXZlX2xvb3Aoc3RydWN0IHNmdHBfY29ubiAqY29ubiwgY2hhciAqZmlsZTEs
IGNoYXIgKmZpbGUyKQogCQlpZiAoc2Z0cF9yZW1vdGVfaXNfZGlyKGNvbm4sIGRpcikgJiYgZmls
ZTIgPT0gTlVMTCkgewogCQkJaWYgKCFxdWlldCkKIAkJCQltcHJpbnRmKCJDaGFuZ2luZyB0bzog
JXNcbiIsIGRpcik7Ci0JCQlzbnByaW50ZihjbWQsIHNpemVvZiBjbWQsICJjZCBcIiVzXCIiLCBk
aXIpOwotCQkJaWYgKHBhcnNlX2Rpc3BhdGNoX2NvbW1hbmQoY29ubiwgY21kLAotCQkJICAgICZy
ZW1vdGVfcGF0aCwgc3RhcnRkaXIsIDEsIDApICE9IDApIHsKKwkJCWlmIChwcm9jZXNzX2NoZGly
KGNvbm4sICZkaXIsICZyZW1vdGVfcGF0aCwKKwkJCSAgICBzdGFydGRpcikgIT0gMCkgewogCQkJ
CWZyZWUoZGlyKTsKIAkJCQlmcmVlKHN0YXJ0ZGlyKTsKIAkJCQlmcmVlKHJlbW90ZV9wYXRoKTsK
LS0gCjIuNTQuMAoK
------=_Part_1549_1070269234.1783855535219
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
openssh-unix-dev mailing list
[email protected]
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

------=_Part_1549_1070269234.1783855535219--