[TALOS-CAN-0062] prevent directory traversal for VMS, too, when using 'saveconfig...

bk: 560c4a7154Z4c1Qe9I0FVv4sGHPnwA

diff --git a/ChangeLog b/ChangeLog
index dc99eab508f9b322fd210a78a52d8a7766592162..6159ec02decbc5f3f867e4165f7fc25849a9eee2 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,6 @@
 ---
+* [TALOS-CAN-0062] prevent directory traversal for VMS, too, when
+  using 'saveconfig' command.  perlinger@ntp.org
 * [TALOS-CAN-0064] signed/unsiged clash could lead to buffer overun
   and memory corruption. perlinger@ntp.org
 * [Bug 2332] (reopened) Exercise thread cancellation once before dropping

diff --git a/ntpd/ntp_control.c b/ntpd/ntp_control.c
index bee2b26d32d23d47a2275d72f3ecd43a97d2f0de..77363117bda4482598a64aec3bb70dc26123a189 100644 (file)
--- a/ntpd/ntp_control.c
+++ b/ntpd/ntp_control.c
@@ -884,6 +884,28 @@ save_config(
        int restrict_mask
        )
 {
+       /* block directory traversal by searching for characters that
+        * indicate directory components in a file path.
+        *
+        * Conceptually we should be searching for DIRSEP in filename,
+        * however Windows actually recognizes both forward and
+        * backslashes as equivalent directory separators at the API
+        * level.  On POSIX systems we could allow '\\' but such
+        * filenames are tricky to manipulate from a shell, so just
+        * reject both types of slashes on all platforms.
+        */     
+       /* TALOS-CAN-0062: block directory traversal for VMS, too */
+       static const char * illegal_in_filename =
+#if defined(VMS)
+           ":[]"       /* do not allow drive and path components here */
+#elif defined(SYS_WINNT)
+           ":\\/"      /* path and drive separators */
+#else
+           "\\/"       /* separator and critical char for POSIX */
+#endif
+           ;
+
+
        char reply[128];
 #ifdef SAVECONFIG
        char filespec[128];
@@ -938,15 +960,9 @@ save_config(
                               localtime(&now)))
                strlcpy(filename, filespec, sizeof(filename));
 
-       /*
-        * Conceptually we should be searching for DIRSEP in filename,
-        * however Windows actually recognizes both forward and
-        * backslashes as equivalent directory separators at the API
-        * level.  On POSIX systems we could allow '\\' but such
-        * filenames are tricky to manipulate from a shell, so just
-        * reject both types of slashes on all platforms.
-        */
-       if (strchr(filename, '\\') || strchr(filename, '/')) {
+       /* block directory/drive traversal */
+       /* TALOS-CAN-0062: block directory traversal for VMS, too */
+       if (NULL != strpbrk(filename, illegal_in_filename)) {
                snprintf(reply, sizeof(reply),
                         "saveconfig does not allow directory in filename");
                ctl_putdata(reply, strlen(reply), 0);