summaryrefslogtreecommitdiff
path: root/apt-pkg/acquire-method.cc
diff options
context:
space:
mode:
authorJulian Andres Klode <jak@debian.org>2019-01-31 15:21:44 +0000
committerJulian Andres Klode <jak@debian.org>2019-01-31 15:21:44 +0000
commita1d9debedcba071d708b3019b5a649314cccb1f6 (patch)
treec7deda87452cbff1ec636e43779b4633a4a1c826 /apt-pkg/acquire-method.cc
parent80282d1830fe31d87c1b67437f17df9a9001c633 (diff)
parent711cda2302b0dfe5d4ab0588b245ae4a97863e5b (diff)
Merge branch 'pu/verify-method-messages-2' into 'master'
Verify data being sent by methods in SendMessage() See merge request apt-team/apt!48
Diffstat (limited to 'apt-pkg/acquire-method.cc')
-rw-r--r--apt-pkg/acquire-method.cc31
1 files changed, 31 insertions, 0 deletions
diff --git a/apt-pkg/acquire-method.cc b/apt-pkg/acquire-method.cc
index c67c47ab8..ae5ae4a15 100644
--- a/apt-pkg/acquire-method.cc
+++ b/apt-pkg/acquire-method.cc
@@ -88,6 +88,37 @@ pkgAcqMethod::pkgAcqMethod(const char *Ver,unsigned long Flags)
/*}}}*/
void pkgAcqMethod::SendMessage(std::string const &header, std::unordered_map<std::string, std::string> &&fields) /*{{{*/
{
+ auto CheckKey = [](std::string const &str) {
+ // Space, hyphen-minus, and alphanum are allowed for keys/headers.
+ return str.find_first_not_of(" -0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz") == std::string::npos;
+ };
+
+ auto CheckValue = [](std::string const &str) {
+ return std::all_of(str.begin(), str.end(), [](unsigned char c) -> bool {
+ return c > 127 // unicode
+ || (c > 31 && c < 127) // printable chars
+ || c == '\n' || c == '\t'; // special whitespace
+ });
+ };
+
+ auto Error = [this]() {
+ _error->Error("SECURITY: Message contains control characters, rejecting.");
+ _error->DumpErrors();
+ SendMessage("400 URI Failure", {{"URI", "<UNKNOWN>"}, {"Message", "SECURITY: Message contains control characters, rejecting."}});
+ abort();
+ };
+
+ if (!CheckKey(header))
+ return Error();
+
+ for (auto const &f : fields)
+ {
+ if (!CheckKey(f.first))
+ return Error();
+ if (!CheckValue(f.second))
+ return Error();
+ }
+
std::cout << header << '\n';
for (auto const &f : fields)
{