]> git.ipfire.org Git - thirdparty/suricata.git/commit
datasets: don't allow absolute or paths with directory traversal
authorJason Ish <jason.ish@oisf.net>
Tue, 23 May 2023 21:17:59 +0000 (15:17 -0600)
committerVictor Julien <vjulien@oisf.net>
Wed, 14 Jun 2023 05:10:57 +0000 (07:10 +0200)
commitfd79b337ca4618d9cf2ac7b37db98f81d97ffab2
treecc27bc5b1e48300672c40db19f8b9843735ed575
parent4a97461f9ab5630f93833051483a8c10cb6724d8
datasets: don't allow absolute or paths with directory traversal

For dataset filenames coming from rules, do not allow filenames that
are absolute or contain a directory traversal with "..". This prevents
datasets from escaping the define data-directory which may allow a bad
rule to overwrite any file that Suricata has permission to write to.

Add a new configuration option,
"datasets.rules.allow-absolute-filenames" to allow absolute filenames
in dataset rules. This will be a way to revert back to the pre 6.0.13
behavior where save/state rules could use any filename.

Ticket: #6118
src/detect-dataset.c
src/util-path.c
src/util-path.h
suricata.yaml.in