summaryrefslogtreecommitdiff
path: root/Git
diff options
context:
space:
mode:
authorGravatar Joey Hess <joeyh@joeyh.name>2017-08-17 22:11:31 -0400
committerGravatar Joey Hess <joeyh@joeyh.name>2017-08-17 22:11:31 -0400
commitc1aec2ae837c24b602c7a0ca3fc7b0fcad565758 (patch)
tree6ce58560d65d4a3a6529569cfdde4c80b6b5e5bf /Git
parentd998fce1481a4bc7779e21cb2ff6a0fa42d72c7a (diff)
avoid the dashed ssh hostname class of security holes
Security fix: Disallow hostname starting with a dash, which would get passed to ssh and be treated an option. This could be used by an attacker who provides a crafted ssh url (for eg a git remote) to execute arbitrary code via ssh -oProxyCommand. No CVE has yet been assigned for this hole. The same class of security hole recently affected git itself, CVE-2017-1000117. Method: Identified all places where ssh is run, by git grep '"ssh"' Converted them all to use a SshHost, if they did not already, for specifying the hostname. SshHost was made a data type with a smart constructor, which rejects hostnames starting with '-'. Note that git-annex already contains extensive use of Utility.SafeCommand, which fixes a similar class of problem where a filename starting with a dash gets passed to a program which treats it as an option. This commit was sponsored by Jochen Bartl on Patreon.
Diffstat (limited to 'Git')
-rw-r--r--Git/Ssh.hs10
1 files changed, 4 insertions, 6 deletions
diff --git a/Git/Ssh.hs b/Git/Ssh.hs
index 206e72113..3c9b23905 100644
--- a/Git/Ssh.hs
+++ b/Git/Ssh.hs
@@ -5,10 +5,11 @@
- Licensed under the GNU GPL version 3 or higher.
-}
-module Git.Ssh where
+module Git.Ssh (module Git.Ssh, module Utility.SshHost) where
import Common
import Utility.Env
+import Utility.SshHost
import Data.Char
@@ -21,9 +22,6 @@ gitSshCommandEnv = "GIT_SSH_COMMAND"
gitSshEnvSet :: IO Bool
gitSshEnvSet = anyM (isJust <$$> getEnv) [gitSshEnv, gitSshCommandEnv]
--- Either a hostname, or user@host
-type SshHost = String
-
type SshPort = Integer
-- Command to run on the remote host. It is run by the shell
@@ -59,8 +57,8 @@ gitSsh' host mp cmd extrasshparams = do
-- Git passes exactly these parameters to the ssh command.
gitps = map Param $ case mp of
- Nothing -> [host, cmd]
- Just p -> [host, "-p", show p, cmd]
+ Nothing -> [fromSshHost host, cmd]
+ Just p -> [fromSshHost host, "-p", show p, cmd]
-- Passing any extra parameters to the ssh command may
-- break some commands.