Qubes/manager
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix boot CD image path validation

Browse Source 
re.match checks only beginning of the path. There should be
re.fullmatch.

Fixes QubesOS/qubes-issues#4860
This commit is contained in:
Marek Marczykowski-Górecki 2019-02-28 06:20:50 +01:00
parent 7874aa73fe
commit f6c8103f46
No known key found for this signature in database
GPG Key ID: 063938BA42CFA724
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
qubesmanager/utils.py
View File

@ -167,7 +167,7 @@ def get_path_from_vm(vm, service_name):
if not untrusted_path: if not untrusted_path:
return None return None
if path_re.match(untrusted_path): if path_re.fullmatch(untrusted_path):
assert '../' not in untrusted_path assert '../' not in untrusted_path
assert '\0' not in untrusted_path assert '\0' not in untrusted_path
return untrusted_path.strip() return untrusted_path.strip()