From 2f486f021aa46d172c7c7e8eef60dc7e22ad49f2 Mon Sep 17 00:00:00 2001
From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
Date: Mon, 20 Jul 2026 07:02:12 +0000
Subject: [PATCH] gdbusauthmechanismsha1: Validate cookie context

Without validation, the server could send a malicious context which
contains path traversal characters, allowing it to exfiltrate a SHA-1
hashed copy of arbitrary data from the client's file system.

To exploit this successfully would require the client to choose to
connect peer-to-peer to a malicious D-Bus server and to choose the SHA-1
authentication mechanism in preference to all the other mechanisms. This
is vanishingly unlikely.

Signed-off-by: Philip Withnall <pwithnall@gnome.org>

Fixes: #3931
---
 gio/gdbusauthmechanismsha1.c | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/gio/gdbusauthmechanismsha1.c b/gio/gdbusauthmechanismsha1.c
index 0cbaf946d..85fb5edc8 100644
--- a/gio/gdbusauthmechanismsha1.c
+++ b/gio/gdbusauthmechanismsha1.c
@@ -1130,6 +1130,34 @@ initial_response = _g_dbus_win32_get_user_sid ();
   return initial_response;
 }
 
+/* Context names must be valid ASCII, nonzero length, and may not contain the
+ * characters slash ("/"), backslash ("\"), space (" "), newline ("\n"),
+ * carriage return ("\r"), tab ("\t"), or period (".").
+ *
+ * See https://dbus.freedesktop.org/doc/dbus-specification.html#auth-mechanisms-sha */
+static gboolean
+validate_cookie_context (const char *cookie_context)
+{
+  size_t i = 0;
+
+  g_return_val_if_fail (cookie_context != NULL, FALSE);
+
+  for (i = 0; cookie_context[i] != '\0'; i++)
+    {
+      if ((guint8) cookie_context[i] >= 128 ||
+          cookie_context[i] == '/' ||
+          cookie_context[i] == '\\' ||
+          cookie_context[i] == ' ' ||
+          cookie_context[i] == '\n' ||
+          cookie_context[i] == '\r' ||
+          cookie_context[i] == '\t' ||
+          cookie_context[i] == '.')
+        return FALSE;
+    }
+
+  return (i > 0);
+}
+
 static void
 mechanism_client_data_receive (GDBusAuthMechanism   *mechanism,
                                const gchar          *data,
@@ -1163,6 +1191,13 @@ mechanism_client_data_receive (GDBusAuthMechanism   *mechanism,
     }
 
   cookie_context = tokens[0];
+  if (!validate_cookie_context (tokens[0]))
+    {
+      g_warning ("Malformed cookie_context '%s'", tokens[0]);
+      m->priv->state = G_DBUS_AUTH_MECHANISM_STATE_REJECTED;
+      goto out;
+    }
+
   cookie_id = g_ascii_strtoll (tokens[1], &endp, 10);
   if (*endp != '\0')
     {