diff options
author | Julian Andres Klode <jak@debian.org> | 2019-01-31 15:21:44 +0000 |
---|---|---|
committer | Julian Andres Klode <jak@debian.org> | 2019-01-31 15:21:44 +0000 |
commit | a1d9debedcba071d708b3019b5a649314cccb1f6 (patch) | |
tree | c7deda87452cbff1ec636e43779b4633a4a1c826 | |
parent | 80282d1830fe31d87c1b67437f17df9a9001c633 (diff) | |
parent | 711cda2302b0dfe5d4ab0588b245ae4a97863e5b (diff) |
Merge branch 'pu/verify-method-messages-2' into 'master'
Verify data being sent by methods in SendMessage()
See merge request apt-team/apt!48
-rw-r--r-- | apt-pkg/acquire-method.cc | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/apt-pkg/acquire-method.cc b/apt-pkg/acquire-method.cc index c67c47ab8..ae5ae4a15 100644 --- a/apt-pkg/acquire-method.cc +++ b/apt-pkg/acquire-method.cc @@ -88,6 +88,37 @@ pkgAcqMethod::pkgAcqMethod(const char *Ver,unsigned long Flags) /*}}}*/ void pkgAcqMethod::SendMessage(std::string const &header, std::unordered_map<std::string, std::string> &&fields) /*{{{*/ { + auto CheckKey = [](std::string const &str) { + // Space, hyphen-minus, and alphanum are allowed for keys/headers. + return str.find_first_not_of(" -0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz") == std::string::npos; + }; + + auto CheckValue = [](std::string const &str) { + return std::all_of(str.begin(), str.end(), [](unsigned char c) -> bool { + return c > 127 // unicode + || (c > 31 && c < 127) // printable chars + || c == '\n' || c == '\t'; // special whitespace + }); + }; + + auto Error = [this]() { + _error->Error("SECURITY: Message contains control characters, rejecting."); + _error->DumpErrors(); + SendMessage("400 URI Failure", {{"URI", "<UNKNOWN>"}, {"Message", "SECURITY: Message contains control characters, rejecting."}}); + abort(); + }; + + if (!CheckKey(header)) + return Error(); + + for (auto const &f : fields) + { + if (!CheckKey(f.first)) + return Error(); + if (!CheckValue(f.second)) + return Error(); + } + std::cout << header << '\n'; for (auto const &f : fields) { |