apt-proxy-users

[Apt-proxy-users] Error in /../ path check in apt-proxy-v2

[Simon H. <sh...@ra...>]

There seems to be an error in the /../ security check in apt_proxy.py in
apt-proxy-v2, around line 1164 in the current CVS version the following
can be found:

        if re.search('/../', self.uri):
            log.debug("/../ in simplified uri ("+self.uri+")")
            self.finishCode(http.FORBIDDEN)
            return

however, since (I believe, I've never written/read python b4) a regular
expression check, and '.' matches anything in a regular expression the
/../ is actually picking up on any directory of 2 characters. This is
causing a request to be rejected if you try to install packages with a 2
char name (such as 'bc' and 'dc'), changing that line to instead read:

        if re.search('/\.\./', self.uri):

seems to resolve the problem.

-- 
Simon Hyde
[insert pointless signature here]

Re: [Apt-proxy-users] Error in /../ path check in apt-proxy-v2

[Chris H. <chr...@gm...>]

On Fri, Sep 13, 2002 at 05:32:15PM +0100, Simon Hyde wrote:
> however, since (I believe, I've never written/read python b4) a regular
> expression check, and '.' matches anything in a regular expression the
> /../ is actually picking up on any directory of 2 characters. This is
> causing a request to be rejected if you try to install packages with a 2
> char name (such as 'bc' and 'dc'), changing that line to instead read:
>=20
>         if re.search('/\.\./', self.uri):
>=20
> seems to resolve the problem.

Yes, you're right!  Thanks for spotting that; I've checked the change into
CVS.

Chris

Re: [Apt-proxy-users] Error in /../ path check in apt-proxy-v2

[Manuel E. S. <ran...@ra...>]

On Fri, Sep 13, 2002 at 07:59:16PM +0200, Chris Halls wrote:
> On Fri, Sep 13, 2002 at 05:32:15PM +0100, Simon Hyde wrote:
> > however, since (I believe, I've never written/read python b4) a regular
> > expression check, and '.' matches anything in a regular expression the
> > /../ is actually picking up on any directory of 2 characters. This is
> > causing a request to be rejected if you try to install packages with a 2
> > char name (such as 'bc' and 'dc'), changing that line to instead read:
> > 
> >         if re.search('/\.\./', self.uri):
> > 
> > seems to resolve the problem.
> 
> Yes, you're right!  Thanks for spotting that; I've checked the change into
> CVS.

 In this case it seams to work but, with regular expresions, raw strings
 should generaly be used, to prevent surprises:

 	if re.search(r'/\.\./', self.uri):

 read http://www.python.org/doc/2.1.3/lib/module-re.html for a nice
 explanation.

   ranty
-- 
--- Manuel Estrada Sainz <ra...@de...>
                         <ra...@bi...>
			 <ra...@us...>
------------------------ <man...@hi...> -------------------
Let us have the serenity to accept the things we cannot change, courage to
change the things we can, and wisdom to know the difference.