Security: Addressed some more situations where symlinked files would be served

by the web interface (STR #4455)

git-svn-id: svn+ssh://src.apple.com/svn/cups/cups.org/trunk@12055 a1ca3aef-8c08-0410-bb20-df032aa958be

diff --git a/CHANGES-1.7.txt b/CHANGES-1.7.txt
index b9e7f050683f3cad0c271ca8fbde0354c9a998fd..77ae38365a7a3fbaa1fcdcbfd3cd1cd8f07500ba 100644 (file)
--- a/CHANGES-1.7.txt
+++ b/CHANGES-1.7.txt
@@ -3,6 +3,8 @@ CHANGES-1.7.txt
 
 CHANGES IN CUPS V1.7.5
 
+       - Security: Addressed some more situations where symlinked files would
+         be served by the web interface (STR #4455)
        - The LPD backend did not work with some versions of glibc (STR #4452)
        - CGI scripts did not work (STR #4454)
 

diff --git a/scheduler/client.c b/scheduler/client.c
index 67a59bc14ef91fc1f14607944d94167fb35f05c9..f252eb26fb60181e6ad0434ff9e7658970325191 100644 (file)
--- a/scheduler/client.c
+++ b/scheduler/client.c
@@ -2959,7 +2959,7 @@ get_file(cupsd_client_t *con,             /* I  - Client connection */
   * then fallback to the default one...
   */
 
-  if ((status = stat(filename, filestats)) != 0 && language[0] &&
+  if ((status = lstat(filename, filestats)) != 0 && language[0] &&
       strncmp(con->uri, "/icons/", 7) &&
       strncmp(con->uri, "/ppd/", 5) &&
       strncmp(con->uri, "/rss/", 5) &&
@@ -3057,13 +3057,13 @@ get_file(cupsd_client_t *con,           /* I  - Client connection */
       plen = len - (size_t)(ptr - filename);
 
       strlcpy(ptr, "index.html", plen);
-      status = stat(filename, filestats);
+      status = lstat(filename, filestats);
 
 #ifdef HAVE_JAVA
       if (status)
       {
        strlcpy(ptr, "index.class", plen);
-       status = stat(filename, filestats);
+       status = lstat(filename, filestats);
       }
 #endif /* HAVE_JAVA */
 
@@ -3071,7 +3071,7 @@ get_file(cupsd_client_t *con,             /* I  - Client connection */
       if (status)
       {
        strlcpy(ptr, "index.pl", plen);
-       status = stat(filename, filestats);
+       status = lstat(filename, filestats);
       }
 #endif /* HAVE_PERL */
 
@@ -3079,7 +3079,7 @@ get_file(cupsd_client_t *con,             /* I  - Client connection */
       if (status)
       {
        strlcpy(ptr, "index.php", plen);
-       status = stat(filename, filestats);
+       status = lstat(filename, filestats);
       }
 #endif /* HAVE_PHP */
 
@@ -3087,18 +3087,28 @@ get_file(cupsd_client_t *con,           /* I  - Client connection */
       if (status)
       {
        strlcpy(ptr, "index.pyc", plen);
-       status = stat(filename, filestats);
+       status = lstat(filename, filestats);
       }
 
       if (status)
       {
        strlcpy(ptr, "index.py", plen);
-       status = stat(filename, filestats);
+       status = lstat(filename, filestats);
       }
 #endif /* HAVE_PYTHON */
 
     }
     while (status && language[0]);
+
+   /*
+    * If we've found a symlink, 404 the sucker to avoid disclosing information.
+    */
+
+    if (!status && S_ISLNK(filestats->st_mode))
+    {
+      cupsdLogClient(con, CUPSD_LOG_INFO, "Symlinks such as \"%s\" are not allowed.", filename);
+      return (NULL);
+    }
   }
 
   cupsdLogClient(con, CUPSD_LOG_DEBUG2, "get_file filestats=%p, filename=%p, len=" CUPS_LLFMT ", returning \"%s\".", filestats, filename, CUPS_LLCAST len, status ? "(null)" : filename);