git@vger.kernel.org list mirror (unofficial, one of many)
 help / color / mirror / Atom feed
* Windows absolute drive path detection incomplete
@ 2019-08-08 16:44 Christopher Ertl
  2019-08-08 16:50 ` Eric Sunshine
  2019-08-09  0:22 ` brian m. carlson
  0 siblings, 2 replies; 4+ messages in thread
From: Christopher Ertl @ 2019-08-08 16:44 UTC (permalink / raw)
  To: git

Hi,

I'd like to report a problem with path validation for Windows, and propose a fix.

Function `verify_path` first calls `has_dos_drive_prefix` in order to prevent absolute drive paths like "C:\xxx". The logic for that is implemented as follows:

#define has_dos_drive_prefix(path) \
	(isalpha(*(path)) && (path)[1] == ':' ? 2 : 0)


The problem is that Windows will still interpret a path like this as an absolute drive path even if the first character isn't alpha, and so it should still be rejected.

In fact, it's actually possible to create drives like that which bypass this filter on Windows (as Administrator), even if it's not an officially supported feature:

>subst 1: C:\Users\x\Desktop

>dir 1:
...

 Directory of 1:\

08/06/2019  06:19 PM    <DIR>          .
08/06/2019  06:19 PM    <DIR>          ..
...


With a drive like this present, a malicious server can write to wherever that drive points when you perform a git clone (to test this, just create a git repository containing :1/file):

>git clone http://x/pathtest
Cloning into 'pathtest'...


>dir pathtest
...
 Directory of pathtest

08/08/2019  04:49 PM    <DIR>          .
08/08/2019  04:49 PM    <DIR>          ..
               0 File(s)              0 bytes


>dir C:\Users\x\Desktop
...
 Directory of C:\Users\x\Desktop

08/08/2019  04:49 PM                 9 file


If the drive doesn't exist, the clone will fail anyway:

>dir 1:
The system cannot find the path specified.

>git clone http://x/pathtest
Cloning into 'pathtest'...
fatal: cannot create directory at '1:': No such file or directory
warning: Clone succeeded, but checkout failed.
You can inspect what was checked out with 'git status'
and retry the checkout with 'git checkout -f HEAD'


So I'm proposing to remove the check for the drive letter being alpha in `has_dos_drive_prefix` macro:

#define has_dos_drive_prefix(path) \
	( (path)[1] == ':' ? 2 : 0)


As well as being a security patch for RCE under very unlikely circumstance, this patch is also a micro performance boost!

Thanks,

Christopher Ertl | MSRC Vulnerabilities & Mitigations | Microsoft Limited 
Microsoft Limited (company number 01624297) is a company registered in England and Wales whose registered office is at Microsoft Campus, Thames Valley Park, Reading. RG6 1WG


^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: Windows absolute drive path detection incomplete
  2019-08-08 16:44 Windows absolute drive path detection incomplete Christopher Ertl
@ 2019-08-08 16:50 ` Eric Sunshine
  2019-08-08 16:58   ` Christopher Ertl
  2019-08-09  0:22 ` brian m. carlson
  1 sibling, 1 reply; 4+ messages in thread
From: Eric Sunshine @ 2019-08-08 16:50 UTC (permalink / raw)
  To: Christopher Ertl; +Cc: git

On Thu, Aug 8, 2019 at 12:45 PM Christopher Ertl
<Christopher.Ertl@microsoft.com> wrote:
> So I'm proposing to remove the check for the drive letter being alpha in `has_dos_drive_prefix` macro:
>
> #define has_dos_drive_prefix(path) \
>         ( (path)[1] == ':' ? 2 : 0)

Nit: This isn't safe and will access memory beyond end-of-string if
path is zero-length. Perhaps something like this would be better:

    #define has_dos_drive_prefix(path) \
        (*(path) && (path)[1] == ':' ? 2 : 0)

^ permalink raw reply	[flat|nested] 4+ messages in thread

* RE: Windows absolute drive path detection incomplete
  2019-08-08 16:50 ` Eric Sunshine
@ 2019-08-08 16:58   ` Christopher Ertl
  0 siblings, 0 replies; 4+ messages in thread
From: Christopher Ertl @ 2019-08-08 16:58 UTC (permalink / raw)
  To: Eric Sunshine; +Cc: git

Thanks, Eric, you're absolutely right; good spot!

Christopher Ertl | MSRC Vulnerabilities & Mitigations | Microsoft Limited 
Microsoft Limited (company number 01624297) is a company registered in England and Wales whose registered office is at Microsoft Campus, Thames Valley Park, Reading. RG6 1WG

-----Original Message-----
From: Eric Sunshine <sunshine@sunshineco.com> 
Sent: Thursday, August 8, 2019 5:51 PM
To: Christopher Ertl <Christopher.Ertl@microsoft.com>
Cc: git@vger.kernel.org
Subject: Re: Windows absolute drive path detection incomplete

On Thu, Aug 8, 2019 at 12:45 PM Christopher Ertl <Christopher.Ertl@microsoft.com> wrote:
> So I'm proposing to remove the check for the drive letter being alpha in `has_dos_drive_prefix` macro:
>
> #define has_dos_drive_prefix(path) \
>         ( (path)[1] == ':' ? 2 : 0)

Nit: This isn't safe and will access memory beyond end-of-string if path is zero-length. Perhaps something like this would be better:

    #define has_dos_drive_prefix(path) \
        (*(path) && (path)[1] == ':' ? 2 : 0)

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: Windows absolute drive path detection incomplete
  2019-08-08 16:44 Windows absolute drive path detection incomplete Christopher Ertl
  2019-08-08 16:50 ` Eric Sunshine
@ 2019-08-09  0:22 ` brian m. carlson
  1 sibling, 0 replies; 4+ messages in thread
From: brian m. carlson @ 2019-08-09  0:22 UTC (permalink / raw)
  To: Christopher Ertl; +Cc: git

[-- Attachment #1: Type: text/plain, Size: 581 bytes --]

On 2019-08-08 at 16:44:52, Christopher Ertl wrote:
> So I'm proposing to remove the check for the drive letter being alpha in `has_dos_drive_prefix` macro:
> 
> #define has_dos_drive_prefix(path) \
> 	( (path)[1] == ':' ? 2 : 0)

Is the drive character required to be ASCII? If it can be non-ASCII
Unicode, then this doesn't work, because the drive character will be
encoded in UTF-8 and will be longer than one character.

An ABNF grammar of valid Windows path names would be helpful here.
-- 
brian m. carlson: Houston, Texas, US
OpenPGP: https://keybase.io/bk2204

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 868 bytes --]

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2019-08-09  0:22 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-08 16:44 Windows absolute drive path detection incomplete Christopher Ertl
2019-08-08 16:50 ` Eric Sunshine
2019-08-08 16:58   ` Christopher Ertl
2019-08-09  0:22 ` brian m. carlson

git@vger.kernel.org list mirror (unofficial, one of many)

This inbox may be cloned and mirrored by anyone:

	git clone --mirror https://public-inbox.org/git
	git clone --mirror http://ou63pmih66umazou.onion/git
	git clone --mirror http://czquwvybam4bgbro.onion/git
	git clone --mirror http://hjrcffqmbrq6wope.onion/git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V1 git git/ https://public-inbox.org/git \
		git@vger.kernel.org
	public-inbox-index git

Example config snippet for mirrors.
Newsgroups are available over NNTP:
	nntp://news.public-inbox.org/inbox.comp.version-control.git
	nntp://ou63pmih66umazou.onion/inbox.comp.version-control.git
	nntp://czquwvybam4bgbro.onion/inbox.comp.version-control.git
	nntp://hjrcffqmbrq6wope.onion/inbox.comp.version-control.git
	nntp://news.gmane.io/gmane.comp.version-control.git
 note: .onion URLs require Tor: https://www.torproject.org/

code repositories for the project(s) associated with this inbox:

	https://80x24.org/mirrors/git.git

AGPL code for this site: git clone https://public-inbox.org/public-inbox.git