summaryrefslogtreecommitdiff
path: root/lib/custodian
diff options
context:
space:
mode:
authorSteve Kemp <steve@steve.org.uk>2012-11-19 14:07:01 +0000
committerSteve Kemp <steve@steve.org.uk>2012-11-19 14:07:01 +0000
commit0f7b20ff39f2f155813510dc25f7b46074c6d34a (patch)
tree8428c574d2d43c932cc3cb258136f21e73376785 /lib/custodian
parentb32255580a14dabbb6f514a81fc252f2b627759d (diff)
Ensure that hostnames used for ping-tests are valid - to avoid the security hole.
Diffstat (limited to 'lib/custodian')
-rw-r--r--lib/custodian/parser.rb10
-rwxr-xr-xlib/custodian/protocol-tests/ping.rb15
2 files changed, 25 insertions, 0 deletions
diff --git a/lib/custodian/parser.rb b/lib/custodian/parser.rb
index 77adc48..ea25c3a 100644
--- a/lib/custodian/parser.rb
+++ b/lib/custodian/parser.rb
@@ -373,6 +373,16 @@ class MonitorConfig
:timeout => @timeout
}
+ #
+ # Sanity check the hostname for ping-tests, to
+ # avoid this security hole:
+ #
+ # $(/tmp/exploit.sh) must run ping ..
+ #
+ if ( service == "ping" )
+ raise ArgumentError, "Invalid hostname for ping-test: #{host}" unless( host =~ /^([a-zA-Z0-9:\-\.]+)$/ )
+ end
+
#
# Alert text will have a default, which may be overridden.
diff --git a/lib/custodian/protocol-tests/ping.rb b/lib/custodian/protocol-tests/ping.rb
index fed72d4..3243b6b 100755
--- a/lib/custodian/protocol-tests/ping.rb
+++ b/lib/custodian/protocol-tests/ping.rb
@@ -72,6 +72,21 @@ class PINGTest
# Get the hostname to test against.
#
host = @test_data['target_host']
+
+
+ #
+ # Sanity check the hostname for ping-tests, to
+ # avoid this security hole:
+ #
+ # $(/tmp/exploit.sh) must run ping ..
+ #
+ raise ArgumentError, "Invalid hostname for ping-test: #{host}" unless( host =~ /^([a-zA-Z0-9:\-\.]+)$/ )
+
+
+
+ #
+ # Show the hostname.
+ #
puts "ping testing host #{host}" if ( @test_data['verbose'] )