summaryrefslogtreecommitdiff
path: root/SECURITY
diff options
context:
space:
mode:
authorSteve Kemp <steve@steve.org.uk>2012-11-19 17:36:24 +0000
committerSteve Kemp <steve@steve.org.uk>2012-11-19 17:36:24 +0000
commit52db57df1e7cf226439ded8f18c901689755b45b (patch)
treed7c8b70b8f4ce98774997a06c6fc0b45537ab432 /SECURITY
parent8254a297c8f44ef935bc84597bd19bc6a425d2a0 (diff)
Avoid using the shell for expansion when invoking curl - this fixes
the potential security hole.
Diffstat (limited to 'SECURITY')
-rw-r--r--SECURITY18
1 files changed, 12 insertions, 6 deletions
diff --git a/SECURITY b/SECURITY
index 2faf51f..bbd44d0 100644
--- a/SECURITY
+++ b/SECURITY
@@ -30,17 +30,21 @@ So the following configuration file potentially allows a command to be executed
Given that anybody who can talk to the beanstalkd server can submit JSON-encoded-jobs we cannot rely on catching this solely in the parser.
-For the moment we've solved the case of the ping-exploitation, because the
-valid hostnames passed there are [a-z0-9.-]. We've not yet sanitized URLs
-because that is a harder job.
+For the moment we've solved the case of the ping-exploitation, by validating
+that hostnames passed to the multi-ping command match ^[a-z0-9.-]$ - both forms
+of input are validated:
-In the case of the ping-test we've done both levels of testing:
-
- * Test the hostname is valid priorer to executing the shell.
+ * Ensuring the hostname is valid prior to executing the shell command.
* Ensure the hostname is valid before adding the job to the queue.
+For HTTP-testing we're avoiding the shell by using the array-based invokation
+of the curl command. We don't perform validation on the URL though, because
+that is a significantly harder jhob.
+
+
+
General
-------
@@ -55,6 +59,8 @@ Problem: We cannot sign the body without giving away our key details.
Solution: Read /etc/custodian/salt, and store the checksum of all keys + values with that salt?
+
+
TODO
----