d358fa780b
Shell syntax is too complicated to detect command substitution and unquoted
operators reliably without implementing much of sh's parser. Therefore, have
sh do this detection.
While changing sh's support anyway, also read input from a pipe instead of
arguments to avoid {ARG_MAX} limits and improve privacy, and output count
and length using 16 instead of 8 digits.
The basic concept is:
execl("/bin/sh", "sh", "-c", "freebsd_wordexp ${1:+\"$1\"} -f "$2",
"", flags & WRDE_NOCMD ? "-p" : "", <pipe with words>);
The WRDE_BADCHAR error is still implemented in libc. POSIX requires us to
fail strings containing unquoted braces with code WRDE_BADCHAR. Since this
is normally not a syntax error in sh, there is still a need for checking
code in libc, we_check().
The new we_check() is an optimistic check that all the characters
<newline> | & ; < > ( ) { }
are quoted. To avoid duplicating too much sh logic, such characters are
permitted when quoting characters are seen, even if the quoting characters
may themselves be quoted. This code reports all WRDE_BADCHAR errors; bad
characters that get past it and are a syntax error in sh return WRDE_SYNTAX.
Although many implementations of WRDE_NOCMD erroneously allow some command
substitutions (and ours even documented this), there appears to be code that
relies on its security (codesearch.debian.net shows quite a few uses).
Passing untrusted data to wordexp() still exposes a denial of service
possibility and a fairly large attack surface.
Reviewed by: wblock (man page only)
MFC after: 2 weeks
Relnotes: yes
Security: fixes command execution with wordexp(untrusted, WRDE_NOCMD)
86 lines
3.4 KiB
C
86 lines
3.4 KiB
C
/*-
|
|
* Copyright (c) 1991, 1993
|
|
* The Regents of the University of California. All rights reserved.
|
|
*
|
|
* This code is derived from software contributed to Berkeley by
|
|
* Kenneth Almquist.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 4. Neither the name of the University nor the names of its contributors
|
|
* may be used to endorse or promote products derived from this software
|
|
* without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*
|
|
* @(#)parser.h 8.3 (Berkeley) 5/4/95
|
|
* $FreeBSD$
|
|
*/
|
|
|
|
/* control characters in argument strings */
|
|
#define CTLESC '\300'
|
|
#define CTLVAR '\301'
|
|
#define CTLENDVAR '\371'
|
|
#define CTLBACKQ '\372'
|
|
#define CTLQUOTE 01 /* ored with CTLBACKQ code if in quotes */
|
|
/* CTLBACKQ | CTLQUOTE == '\373' */
|
|
#define CTLARI '\374'
|
|
#define CTLENDARI '\375'
|
|
#define CTLQUOTEMARK '\376'
|
|
#define CTLQUOTEEND '\377' /* only for ${v+-...} */
|
|
|
|
/* variable substitution byte (follows CTLVAR) */
|
|
#define VSTYPE 0x0f /* type of variable substitution */
|
|
#define VSNUL 0x10 /* colon--treat the empty string as unset */
|
|
#define VSLINENO 0x20 /* expansion of $LINENO, the line number \
|
|
follows immediately */
|
|
#define VSQUOTE 0x80 /* inside double quotes--suppress splitting */
|
|
|
|
/* values of VSTYPE field */
|
|
#define VSNORMAL 0x1 /* normal variable: $var or ${var} */
|
|
#define VSMINUS 0x2 /* ${var-text} */
|
|
#define VSPLUS 0x3 /* ${var+text} */
|
|
#define VSQUESTION 0x4 /* ${var?message} */
|
|
#define VSASSIGN 0x5 /* ${var=text} */
|
|
#define VSTRIMLEFT 0x6 /* ${var#pattern} */
|
|
#define VSTRIMLEFTMAX 0x7 /* ${var##pattern} */
|
|
#define VSTRIMRIGHT 0x8 /* ${var%pattern} */
|
|
#define VSTRIMRIGHTMAX 0x9 /* ${var%%pattern} */
|
|
#define VSLENGTH 0xa /* ${#var} */
|
|
#define VSERROR 0xb /* Syntax error, issue when expanded */
|
|
|
|
|
|
/*
|
|
* NEOF is returned by parsecmd when it encounters an end of file. It
|
|
* must be distinct from NULL.
|
|
*/
|
|
#define NEOF ((union node *)-1)
|
|
extern int whichprompt; /* 1 == PS1, 2 == PS2 */
|
|
extern const char *const parsekwd[];
|
|
|
|
|
|
union node *parsecmd(int);
|
|
union node *parsewordexp(void);
|
|
void forcealias(void);
|
|
void fixredir(union node *, const char *, int);
|
|
int goodname(const char *);
|
|
int isassignment(const char *);
|
|
char *getprompt(void *);
|
|
const char *expandstr(const char *);
|