koji

#563 Possible to bypass allowed_scm blacklist
Closed: Fixed Opened by puiterwijk.

Closed: Fixed
Reopen Issue

The SCM blacklist does not normalize paths, which means that if you blacklist /forks, ./forks is still possible.

A patch for this is attached.
0001-Run-normpath-over-SCM-url-when-checking-against-allo.patch

Retrying attach...

0001-Run-normpath-over-SCM-url-when-checking-against-allo.patch

Thanks, looks fine. I'll merge this before 1.14

Metadata Update from @mikem:
- Issue set to the milestone: 1.14

This issue has been assigned CVE-2017-1002153.

0001-fix-up-url-checks-and-extend-unit-tests-for-this-iss.patch

The previous patch adjusts some checks, extends the unit tests to cover the sorts of urls we're concerned with, and preserves our code coverage.

It also catches paths starting with //, which normpath for some reason does not.

This patch looks good to me.

Side note: here is the reason normpath allows // at the beginning:

https://unix.stackexchange.com/questions/12283/unix-difference-between-path-starting-with-and

This is not applicable in any of our urls, so our squashing of // to / is correct.

Metadata Update from @mikem:
- Issue private status set to: False (was: True)

Commit ba7b5a3c fixes this issue

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/koji/issues/563

Please continue any further discussion there.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.