diff options
Diffstat (limited to 'lib/custodian')
| -rw-r--r-- | lib/custodian/parser.rb | 10 | ||||
| -rwxr-xr-x | lib/custodian/protocol-tests/ping.rb | 15 |
2 files changed, 25 insertions, 0 deletions
diff --git a/lib/custodian/parser.rb b/lib/custodian/parser.rb index 77adc48..ea25c3a 100644 --- a/lib/custodian/parser.rb +++ b/lib/custodian/parser.rb @@ -373,6 +373,16 @@ class MonitorConfig :timeout => @timeout } + # + # Sanity check the hostname for ping-tests, to + # avoid this security hole: + # + # $(/tmp/exploit.sh) must run ping .. + # + if ( service == "ping" ) + raise ArgumentError, "Invalid hostname for ping-test: #{host}" unless( host =~ /^([a-zA-Z0-9:\-\.]+)$/ ) + end + # # Alert text will have a default, which may be overridden. diff --git a/lib/custodian/protocol-tests/ping.rb b/lib/custodian/protocol-tests/ping.rb index fed72d4..3243b6b 100755 --- a/lib/custodian/protocol-tests/ping.rb +++ b/lib/custodian/protocol-tests/ping.rb @@ -72,6 +72,21 @@ class PINGTest # Get the hostname to test against. # host = @test_data['target_host'] + + + # + # Sanity check the hostname for ping-tests, to + # avoid this security hole: + # + # $(/tmp/exploit.sh) must run ping .. + # + raise ArgumentError, "Invalid hostname for ping-test: #{host}" unless( host =~ /^([a-zA-Z0-9:\-\.]+)$/ ) + + + + # + # Show the hostname. + # puts "ping testing host #{host}" if ( @test_data['verbose'] ) |