Paths

Table of Contentst

Differential D18388

Increase strictness of URI parsing, rejecting URIs in the form "ssh://-flag"
ClosedPublic
Actions

Authored by epriestley on Aug 10 2017, 10:23 PM.

Tags

None

Subscribers

None

Details

Reviewers

Maniphest Tasks

T12961: [CVE-2017-1000117, et al] Git, Mercurial and Subversion could all execute arbitrary commands when interacting with malicious SSH URIs (`ssh://-...`)

Commits

rPHUee5ebf668ad4: (stable) Promote 2017 Week 32
rPHU276f6d304b69: Increase strictness of URI parsing, rejecting URIs in the form "ssh://-flag"

Summary

Ref T12961. See that task for discussion of the major attack we're responding to here.

Reject hosts beginning with "-". These are not legitimate.
Reject hosts beginning with ".". These are also not legitimate.
Tighten $ to \z. $ can match either "newline, end of string" or "end of string". \z matches ONLY "end of string". We don't want to match a newline, only "end of string" strictly.
We already that hosts otherwise contain only "reasonable" characters (letters, numbers, hyphens, and periods).

Test Plan

Added unit tests, ran unit tests.
Tried to set a repository URI to ssh://-oxyz/path with these changes, which worked previously; it no longer works.

Diff Detail

Repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

Slightly better test case for \z.

Harbormaster completed remote builds in B17991: Diff 44197.Aug 10 2017, 10:23 PM

Harbormaster completed remote builds in B17992: Diff 44198.

chad accepted this revision.Aug 10 2017, 10:23 PM

This revision is now accepted and ready to land.Aug 10 2017, 10:23 PM

Closed by commit rPHU276f6d304b69: Increase strictness of URI parsing, rejecting URIs in the form "ssh://-flag" (authored by epriestley, committed by epriestley). · Explain WhyAug 10 2017, 10:32 PM

This revision was automatically updated to reflect the committed changes.

epriestley mentioned this in T12961: [CVE-2017-1000117, et al] Git, Mercurial and Subversion could all execute arbitrary commands when interacting with malicious SSH URIs (`ssh://-...`).Aug 10 2017, 10:48 PM

Revision Contents
Changeset List

Path

Size

src/

parser/

10 lines

__tests__/

PhutilURITestCase.php

14 lines

Diff 44199

src/parser/PhutilURI.php

Loading...

src/parser/tests/PhutilURITestCase.php

Loading...