Changeset c426bc2

Timestamp:

Jan 20, 2011, 7:59:38 PM (14 years ago)

Author:

David Benjamin <davidben@mit.edu>

Branches:

master, release-1.10, release-1.8, release-1.9

Children:

a5f477c

Parents:

f47696f

git-author:

David Benjamin <davidben@mit.edu> (01/02/11 20:25:46)

git-committer:

David Benjamin <davidben@mit.edu> (01/20/11 19:59:38)

Message:

Rewrite owl_function_classinstfilt with proper quoting

The current ad-hoc code fails to handle tabs, which allows an attacker
to force a failed parse or run an arbitrary perl function.
[nelhage@nelhage.com: Use owl_string_appendf_quoted]

File:

• functions.c (modified) (2 diffs)

functions.c

@@ -2286 +2286 @@
 {
   owl_filter *f;
-  char *argbuff, *filtname;
+  char *filtname;
   char *tmpclass, *tmpinstance = NULL;
   char *class, *instance = NULL;
+  GString *buf;
 
   if (related) {
@@ -2328 +2329 @@
   /* create the new filter */
   tmpclass=owl_text_quote(class, OWL_REGEX_QUOTECHARS, OWL_REGEX_QUOTEWITH);
-  owl_text_tr(tmpclass, ' ', '.');
-  owl_text_tr(tmpclass, '\'', '.');
-  owl_text_tr(tmpclass, '"', '.');
   if (instance) {
     tmpinstance=owl_text_quote(instance, OWL_REGEX_QUOTECHARS, OWL_REGEX_QUOTEWITH);
-    owl_text_tr(tmpinstance, ' ', '.');
-    owl_text_tr(tmpinstance, '\'', '.');
-    owl_text_tr(tmpinstance, '"', '.');
-  }
-
-  argbuff = owl_sprintf(related ? "class ^(un)*%s(\\.d)*$" : "class ^%s$", tmpclass);
+  }
+
+  buf = g_string_new("");
+  owl_string_appendf_quoted(buf,
+                            related ? "class ^(un)*%q(\\.d)*$" : "class ^%q$",
+                            tmpclass);
+
   if (tmpinstance) {
-    char *tmp = argbuff;
-    argbuff = owl_sprintf(related ? "%s and ( instance ^(un)*%s(\\.d)*$ )" : "%s and instance ^%s$", tmp, tmpinstance);
-    owl_free(tmp);
+    owl_string_appendf_quoted(buf,
+                              related ?
+                              " and ( instance ^(un)*%q(\\.d)*$ )" :
+                              " and instance ^%q$",
+                              tmpinstance);
   }
   owl_free(tmpclass);
-  if (tmpinstance) owl_free(tmpinstance);
-
-  f = owl_filter_new_fromstring(filtname, argbuff);
-  owl_free(argbuff);
+  owl_free(tmpinstance);
+
+  f = owl_filter_new_fromstring(filtname, buf->str);
+  g_string_free(buf, true);
   if (f == NULL) {
     /* Couldn't make a filter for some reason. Return NULL. */