From c1aec2ae837c24b602c7a0ca3fc7b0fcad565758 Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Thu, 17 Aug 2017 22:11:31 -0400 Subject: avoid the dashed ssh hostname class of security holes Security fix: Disallow hostname starting with a dash, which would get passed to ssh and be treated an option. This could be used by an attacker who provides a crafted ssh url (for eg a git remote) to execute arbitrary code via ssh -oProxyCommand. No CVE has yet been assigned for this hole. The same class of security hole recently affected git itself, CVE-2017-1000117. Method: Identified all places where ssh is run, by git grep '"ssh"' Converted them all to use a SshHost, if they did not already, for specifying the hostname. SshHost was made a data type with a smart constructor, which rejects hostnames starting with '-'. Note that git-annex already contains extensive use of Utility.SafeCommand, which fixes a similar class of problem where a filename starting with a dash gets passed to a program which treats it as an option. This commit was sponsored by Jochen Bartl on Patreon. --- Git/Ssh.hs | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) (limited to 'Git') diff --git a/Git/Ssh.hs b/Git/Ssh.hs index 206e72113..3c9b23905 100644 --- a/Git/Ssh.hs +++ b/Git/Ssh.hs @@ -5,10 +5,11 @@ - Licensed under the GNU GPL version 3 or higher. -} -module Git.Ssh where +module Git.Ssh (module Git.Ssh, module Utility.SshHost) where import Common import Utility.Env +import Utility.SshHost import Data.Char @@ -21,9 +22,6 @@ gitSshCommandEnv = "GIT_SSH_COMMAND" gitSshEnvSet :: IO Bool gitSshEnvSet = anyM (isJust <$$> getEnv) [gitSshEnv, gitSshCommandEnv] --- Either a hostname, or user@host -type SshHost = String - type SshPort = Integer -- Command to run on the remote host. It is run by the shell @@ -59,8 +57,8 @@ gitSsh' host mp cmd extrasshparams = do -- Git passes exactly these parameters to the ssh command. gitps = map Param $ case mp of - Nothing -> [host, cmd] - Just p -> [host, "-p", show p, cmd] + Nothing -> [fromSshHost host, cmd] + Just p -> [fromSshHost host, "-p", show p, cmd] -- Passing any extra parameters to the ssh command may -- break some commands. -- cgit v1.2.3