You are here: Foswiki>Tasks Web>Item12391 (28 Feb 2013, GeorgeClark)Edit Attach

Item12391: Fix for Support.SecurityAlert-CVE-2013-1666

pencil
Priority: Urgent
Current State: Closed
Released In: 1.1.8
Target Release: patch
Applies To: Engine
Component: MAKETEXT
Branches: Release01x01 trunk
Reported By: GeorgeClark
Waiting For:
Last Change By: GeorgeClark
Here's some work in progress for a more thorough guard against this vector. Still work in progress but the idea is to properly parse maketext args instead of escaping brackets, which in effect breaks some of the nicer features of Locale::Maketext.

sub validateMaketextParams {
  my $text = shift;

  # from Locale::Maketext
  my $in_group = 0; # start out outside a group
  my @c;

  while($text =~  # Iterate over chunks.
      m/(
          [^\~\[\]]+  # non-~[] stuff (Capture everything else here)
          |
          ~.       # ~[, ~], ~~, ~other
          |
          \[          # [ presumably opening a group
          |
          \]          # ] presumably closing a group
          |
          ~           # terminal ~ ?
          |
          $
      )/xgs
  ) {

    #print STDERR "chunk = $1\n";

    if($1 eq '[' or $1 eq '') {       # "[" or end
      $in_group = 1;
    } elsif($1 eq ']') {  # "]"
      $in_group = 0;
      my ($method, @params) = split(/,/, $c[-1], -1);

      #print STDERR "method='$method'\n";
      throw Error::Simple("invalid method $method") 
        unless $method =~ /^(_\*|_\-?\d+|\*|\#|quant|numf|numerate|sprintf)$/;
    } 

    push @c, $1;
  }

  return 1;
}

-- MichaelDaum - 19 Feb 2013

ItemTemplate edit

Summary Fix for Support.SecurityAlert-CVE-2013-1666
ReportedBy GeorgeClark
Codebase 1.1.7, 1.1.6, 1.1.6 dev, 1.1.5, 1.1.5 RC2, 1.1.5 RC1, 1.1.4, 1.1.4 RC2, 1.1.4 RC1, 1.1.4 beta2, 1.1.4 beta1, 1.1.3, 1.1.3 RC1, 1.1.3 beta1, 1.1.2, 1.1.1, 1.1.0, 1.1.0 beta1, 1.0.10, 1.0.9, 1.0.8, 1.0.7, 1.0.6, 1.0.5, 1.0.5 beta1, 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0, 1.0.0 beta3, 1.0.0 beta2, 1.0.0 beta1, trunk
SVN Range
AppliesTo Engine
Component MAKETEXT
Priority Urgent
CurrentState Closed
WaitingFor
Checkins distro:2f42e93d9c88 distro:1828327c92d2 distro:b674a610478f PatchItem12391Contrib:8914d7afc05f PatchItem12391Contrib:0e4300dda7ab distro:c067f3148888 distro:7004a9c135d5 PatchItem12391Contrib:a395bb41f23c distro:9bba5876e164 distro:6d0ffc5432ba
TargetRelease patch
ReleasedIn 1.1.8
CheckinsOnBranches Release01x01 trunk
trunkCheckins distro:2f42e93d9c88 distro:b674a610478f PatchItem12391Contrib:8914d7afc05f PatchItem12391Contrib:0e4300dda7ab PatchItem12391Contrib:a395bb41f23c distro:9bba5876e164
Release01x01Checkins distro:1828327c92d2 distro:c067f3148888 distro:7004a9c135d5 distro:6d0ffc5432ba
Topic revision: r14 - 28 Feb 2013, GeorgeClark
The copyright of the content on this website is held by the contributing authors, except where stated elsewhere. See Copyright Statement. Creative Commons License    Legal Imprint    Privacy Policy