YunoHost/package_linter
1
0
Fork 0
mirror of https://github.com/YunoHost/package_linter.git synced 2024-09-03 20:06:12 +02:00
Code Issues Projects Releases Packages Wiki Activity

Fix path traversal issue detection, the alias folder also needs to end with / for path traversal to happen

Browse source
This commit is contained in:
Alexandre Aubin 2019-03-20 20:32:30 +01:00 committed by Alexandre Aubin
parent acc32c9796
commit 16bb33b884
1 changed files with 6 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
package_linter.py
View file

@ -196,7 +196,7 @@ class App():
for line in locationblock[1]: for line in locationblock[1]:
instruction = line[0] instruction = line[0]
if instruction == "alias": if instruction == "alias":
yield location yield (location, line)
elif isinstance(instruction, list) and instruction and instruction[0] == "location": elif isinstance(instruction, list) and instruction and instruction[0] == "location":
yield from find_location_with_alias(instruction) yield from find_location_with_alias(instruction)
else: else:
@ -205,17 +205,18 @@ class App():
def find_path_traversal_issue(nginxconf): def find_path_traversal_issue(nginxconf):
for block in nginxconf: for block in nginxconf:
for location in find_location_with_alias(block): for location, alias in find_location_with_alias(block):
if not location.endswith("/"): alias_path = alias[-1]
if not location.endswith("/") and alias_path.endswith("/"):
yield location yield location
for location in find_path_traversal_issue(nginxconf): for location in find_path_traversal_issue(nginxconf):
print_warning( print_warning(
"The nginx configuration (especially location %s) " "The nginx configuration (especially location %s) "
"appears vulnerable to path traversal issues as explained in\n" "appears vulnerable to path traversal issues as explained in\n"
"https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/\n" " https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/\n"
"To fix it, look at the first lines of the nginx conf of the example app : \n" "To fix it, look at the first lines of the nginx conf of the example app : \n"
"https://github.com/YunoHost/example_ynh/blob/master/conf/nginx.conf" % location " https://github.com/YunoHost/example_ynh/blob/master/conf/nginx.conf" % location
) )
def check_helper_consistency(self): def check_helper_consistency(self):