Re: [Flightgear-devel] Nasal security

[Alex R. <ro...@sy...>]

"Rebecca N. Palmer" <reb...@zo...> writes:

> Looks like some of the test cases in fgInitAllowedPaths() may not 
> actually be legal paths, which now matters since we're using realpath(); 
> I have just pushed a possible fix, though I can't be sure since my 
> (64-bit Linux) system didn't have the issue.
>
> If it still doesn't work, please recompile with this to determine 
> exactly what is failing:
>
> diff --git a/src/Main/util.cxx b/src/Main/util.cxx
> index 40d3244..aaaa468 100644
> --- a/src/Main/util.cxx
> +++ b/src/Main/util.cxx
> @@ -194,6 +194,7 @@ static std::string fgValidatePath_internal
>           }
>       }
>       // no match found
> +    SG_LOG(SG_NASAL, SG_ALERT, "Access denied to " << normed_path);
>       return "";
>   }
>   // Check whether Nasal is allowed to access a path

still no go. this is the output with your patch applied:

default catalog not found, installing 'org.flightgear.default' from 'http://fgfs.goneabitbursar.com/pkg/3.6.0/default-catalog.xml'.
FATAL:fgInitAllowedPaths() does not work

Access denied to /home/romosan/no.log
Access denied to /home/romosan/.fgfs/no.logt
Access denied to /home/romosan/.fgfs/nolog
Access denied to /home/romosan/.fgfsno.log
Access denied to /home/romosan/no.log
ERROR: The path '/home/romosan/.fgfs/./TerraSync/../Export' does not exist in the file system.
Access denied to /home/romosan/.fgfs/./TerraSync/../Export/yes..gg

--alex--

-- 
| I believe the moment is at hand when, by a paranoiac and active |
|  advance of the mind, it will be possible (simultaneously with  |
|  automatism and other passive states) to systematize confusion  |
|  and thus to help to discredit completely the world of reality. |