126 lines
3.4 KiB
Diff
126 lines
3.4 KiB
Diff
From 1694606e12d8950b003ff86248883732ef05e00c Mon Sep 17 00:00:00 2001
|
|
From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
|
|
Date: Fri, 19 Jun 2020 11:59:33 +0200
|
|
Subject: [PATCH] tests: Add test for CVE-2019-14889
|
|
|
|
The test checks if a command appended to the file path is not executed.
|
|
|
|
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
|
|
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
|
|
---
|
|
tests/client/torture_scp.c | 84 ++++++++++++++++++++++++++++++++++++++
|
|
1 file changed, 84 insertions(+)
|
|
|
|
diff --git a/tests/client/torture_scp.c b/tests/client/torture_scp.c
|
|
index 8f080af3..59a00bae 100644
|
|
--- a/tests/client/torture_scp.c
|
|
+++ b/tests/client/torture_scp.c
|
|
@@ -37,6 +37,7 @@
|
|
#define BUF_SIZE 1024
|
|
|
|
#define TEMPLATE BINARYDIR "/tests/home/alice/temp_dir_XXXXXX"
|
|
+#define ALICE_HOME BINARYDIR "/tests/home/alice"
|
|
|
|
struct scp_st {
|
|
struct torture_state *s;
|
|
@@ -540,6 +541,86 @@ static void torture_scp_upload_newline(void **state)
|
|
fclose(file);
|
|
}
|
|
|
|
+static void torture_scp_upload_appended_command(void **state)
|
|
+{
|
|
+ struct scp_st *ts = NULL;
|
|
+ struct torture_state *s = NULL;
|
|
+
|
|
+ ssh_session session = NULL;
|
|
+ ssh_scp scp = NULL;
|
|
+
|
|
+ FILE *file = NULL;
|
|
+
|
|
+ char buf[1024];
|
|
+ char *rs = NULL;
|
|
+ int rc;
|
|
+
|
|
+ assert_non_null(state);
|
|
+ ts = *state;
|
|
+
|
|
+ assert_non_null(ts->s);
|
|
+ s = ts->s;
|
|
+
|
|
+ session = s->ssh.session;
|
|
+ assert_non_null(session);
|
|
+
|
|
+ assert_non_null(ts->tmp_dir_basename);
|
|
+ assert_non_null(ts->tmp_dir);
|
|
+
|
|
+ /* Upload a file path with a command appended */
|
|
+
|
|
+ /* Append a command to the file path */
|
|
+ snprintf(buf, BUF_SIZE, "%s"
|
|
+ "/;touch hack",
|
|
+ ts->tmp_dir);
|
|
+
|
|
+ /* When writing the file_name must be the directory name */
|
|
+ scp = ssh_scp_new(session, SSH_SCP_WRITE | SSH_SCP_RECURSIVE,
|
|
+ buf);
|
|
+ assert_non_null(scp);
|
|
+
|
|
+ rc = ssh_scp_init(scp);
|
|
+ assert_ssh_return_code(session, rc);
|
|
+
|
|
+ /* Push directory where the new file will be copied */
|
|
+ rc = ssh_scp_push_directory(scp, ";touch hack", 0755);
|
|
+ assert_ssh_return_code(session, rc);
|
|
+
|
|
+ /* Try to push file */
|
|
+ rc = ssh_scp_push_file(scp, "original", 8, 0644);
|
|
+ assert_ssh_return_code(session, rc);
|
|
+
|
|
+ rc = ssh_scp_write(scp, "original", 8);
|
|
+ assert_ssh_return_code(session, rc);
|
|
+
|
|
+ /* Leave the directory */
|
|
+ rc = ssh_scp_leave_directory(scp);
|
|
+ assert_ssh_return_code(session, rc);
|
|
+
|
|
+ /* Cleanup */
|
|
+ ssh_scp_close(scp);
|
|
+ ssh_scp_free(scp);
|
|
+
|
|
+ /* Make sure the command was not executed */
|
|
+ snprintf(buf, BUF_SIZE, ALICE_HOME "/hack");
|
|
+ file = fopen(buf, "r");
|
|
+ assert_null(file);
|
|
+
|
|
+ /* Open the file and check content */
|
|
+ snprintf(buf, BUF_SIZE, "%s"
|
|
+ "/;touch hack/original",
|
|
+ ts->tmp_dir);
|
|
+
|
|
+ file = fopen(buf, "r");
|
|
+ assert_non_null(file);
|
|
+
|
|
+ rs = fgets(buf, 1024, file);
|
|
+ assert_non_null(rs);
|
|
+ assert_string_equal(buf, "original");
|
|
+
|
|
+ fclose(file);
|
|
+}
|
|
+
|
|
int torture_run_tests(void)
|
|
{
|
|
int rc;
|
|
@@ -559,6 +640,9 @@ int torture_run_tests(void)
|
|
cmocka_unit_test_setup_teardown(torture_scp_upload_newline,
|
|
session_setup,
|
|
session_teardown),
|
|
+ cmocka_unit_test_setup_teardown(torture_scp_upload_appended_command,
|
|
+ session_setup,
|
|
+ session_teardown),
|
|
};
|
|
|
|
ssh_init();
|
|
--
|
|
2.26.2
|
|
|