Re: [Linuxcoe-devel] =?iso-8859-1?q?=5BPATCH=5D_patches_for_multiple-?= =?iso-8859-1?q?serial_numbers_SIM=09installs?=

[Daniel M. <dan...@hp...>]

On Tuesday 05 June 2007 11:44:09 am Lee Mayes wrote:
> Hi Daniel,
>
>   I have a couple of questions for you.  I've incorporated your patches
> in my upstream here to start testing but have not checked anything in
> yet.  A few questions/observations:
>
>   When your code is in play, I noticed you can no longer enter a single
> serial number (but of course you could create a file with a single s/n
> in it).  Is this the desired behavior or should I change things to allow
> either single serial number or a file of serial numbers?

Technically I suppose it was desired behavior, but I'm not opposed to allowing 
both.

>
>   Looking at the changes in nph-coe_image (kickstart generator
> back-end), I see you load the file into an array (@serial), pop the
> first value off of it for the initial generation, then basically symlink
> the rest of the results based on data values from the file.  I'm going
> to add some defensive code here, as someone nasty could for example use
> ../../../../../etc/passwd as a serial # in the file and the code would
> attempt to crush that file.  Granted standard unix perms would prevent
> that one, but any file the apache user could write to is portentially
> vulnerable.

Ooh, good catch... I didn't allow users to name their own files when they 
uploaded them, but I never thought about this one.

Do you think it'd be appropriate to just add code that checked for ".." in the 
line, and refused to create the file if it finds it?