diff options
author | Douwe Maan <douwe@gitlab.com> | 2015-06-12 17:17:04 +0300 |
---|---|---|
committer | Douwe Maan <douwe@gitlab.com> | 2015-06-12 17:17:04 +0300 |
commit | 313438b327b49b5055772368c141617e06602b5b (patch) | |
tree | 0a70fa4af7e620eb2f604de18c57fc23ca84251b /doc | |
parent | 9ea8dcb5e206bc9bf566ad2aebd167d20ec85531 (diff) |
Add info about regex anchors to shell command docs.
Diffstat (limited to 'doc')
-rw-r--r-- | doc/development/shell_commands.md | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/doc/development/shell_commands.md b/doc/development/shell_commands.md index 821027f43fa..2d1d0fb4154 100644 --- a/doc/development/shell_commands.md +++ b/doc/development/shell_commands.md @@ -177,3 +177,33 @@ File.open(full_path) do # Etc. ``` A check like this could have avoided CVE-2013-4583. + +## Properly anchor regular expressions to the start and end of strings + +When using regular expressions to validate user input that is passed as an argument to a shell command, make sure to use the `\A` and `\z` anchors that designate the start and end of the string, rather than `^` and `$`, or no anchors at all. + +If you don't, an attacker could use this to execute commands with potentially harmful effect. + +For example, when a project's `import_url` is validated like below, the user could trick GitLab into cloning from a Git repository on the local filesystem. + +```ruby +validates :import_url, format: { with: URI.regexp(%w(ssh git http https)) } +# URI.regexp(%w(ssh git http https)) roughly evaluates to /(ssh|git|http|https):(something_that_looks_like_a_url)/ +``` + +Suppose the user submits the following as their import URL: + +``` +file://git:/tmp/lol +``` + +Since there are no anchors in the used regular expression, the `git:/tmp/lol` in the value would match, and the validation would pass. + +When importing, GitLab would execute the following command, passing the `import_url` as an argument: + + +```sh +git clone file://git:/tmp/lol +``` + +Git would simply ignore the `git:` part, interpret the path as `file:///tmp/lol` and import the repository into the new project, in turn potentially giving the attacker access to any repository in the system, whether private or not. |