diff options
| author | Werner Koch <[email protected]> | 2022-07-25 07:46:41 +0000 |
|---|---|---|
| committer | Werner Koch <[email protected]> | 2022-07-25 08:21:44 +0000 |
| commit | 8a63a8c8257e5c585ec6fee49f38050dbf20354b (patch) | |
| tree | 276d6d1245c91bde48c82076010dd309ede5102e /tools/gpg-wks-server.c | |
| parent | build: Update gpg-error.m4. (diff) | |
| download | gnupg-8a63a8c8257e5c585ec6fee49f38050dbf20354b.tar.gz gnupg-8a63a8c8257e5c585ec6fee49f38050dbf20354b.zip | |
wkd: Fix path traversal attack on gpg-wks-server.
* tools/gpg-wks-server.c (check_and_publish): Check for invalid
characters in sender controlled data.
* tools/wks-util.c (wks_fname_from_userid): Ditto.
(wks_compute_hu_fname): Ditto.
(ensure_policy_file): Ditto.
Diffstat (limited to 'tools/gpg-wks-server.c')
| -rw-r--r-- | tools/gpg-wks-server.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/tools/gpg-wks-server.c b/tools/gpg-wks-server.c index 2ea5d9117..451fa3c81 100644 --- a/tools/gpg-wks-server.c +++ b/tools/gpg-wks-server.c @@ -1379,6 +1379,15 @@ check_and_publish (server_ctx_t ctx, const char *address, const char *nonce) domain = strchr (address, '@'); log_assert (domain && domain[1]); domain++; + if (strchr (domain, '/') || strchr (domain, '\\') + || strchr (nonce, '/') || strchr (nonce, '\\')) + { + log_info ("invalid domain or nonce received ('%s', '%s')\n", + domain, nonce); + err = gpg_error (GPG_ERR_NOT_FOUND); + goto leave; + } + fname = make_filename_try (opt.directory, domain, "pending", nonce, NULL); if (!fname) { |