-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Thanks for your reply! In fact the question is not "how to do it" but "is someone doing it on the TS already"? (XSLT sounds intressting and was new to me - but I would prefer python since this is something I know already... ;) Greetings

(anonymous) wrote: Please consider that very, very, very simple scripts typi- cally have very, very, very bad security protections :-). In this case, all files on the toolserver can be checked for existence, if they are XML files and the attacker can depos- it an XSLT file somewhere on the toolserver they can be read and accesses to external URLs can be triggered. Tim

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Am 11.09.2011 20:50, schrieb DaB.: Sorry for the inconveniences I caused here! What is exactly the critical point you are mentioning? Do I understand you right and would inserting the code import os allowed = [item for item in os.listdir('.') if '.xslt' in item] if xslt not in allowed: # return some neutral/blank message (hiding all sentive data) which just allows access to "my" 'xslt' files in 'cgi-bin' satisfy those needs in security? Or do you have something else in mind? (disabling debug info, moving 'xslt' files to another directory, or even more restrictive, ...?) Thanks for your feedback and greetings DrTrigon

On 11 September 2011 22:59, Platonides <platonides(a)gmail.com> wrote: It even works without. For urllib2, you do need to use file:// urls. valhallasw@dorthonion:~$ python Python 2.6.5 (r265:79063, Apr 16 2010, 13:09:56) [GCC 4.4.3] on linux2 Type "help", "copyright", "credits" or "license" for more information. ['root:x:0:0:root:/root:/bin/bash\n', (...) ,'usbmux:x:109:46:usbmux daemon,,,:/home/usbmux:/bin/false\n'] ['root:x:0:0:root:/root:/bin/bash\n', (...) Of course, it all boils back to the old motto 'never trust user input' - and be sure standard libraries are not more general than you think... (and this is something that might have bitten more of us, including me :-)) Best, Merlijn

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Am 11.09.2011 22:59, schrieb Platonides: Sorry that answer confuses me; "check that xslt is only composed by alphanumeric characters" is just a second (more paranoid) check to be very sure? Since only xslt from my path are allowed, I would have to put them into this directory and do check them then... The other thing is the content of this xslt will be passed to 'etree.XML' like: so why should there be a problem if the xslt would contain binary data (which in fact they would not since I have to upload them... ;) Am 11.09.2011 23:29, schrieb Merlijn van Deen: > On 11 September 2011 22:59, Platonides &lt;platonides(a)gmail.com > <mailto:platonides@gmail.com>> wrote: > > > > It even works without. For urllib2, you do need to use file:// > urls. > > valhallasw@dorthonion:~$ python Python 2.6.5 (r265:79063, Apr 16 > 2010, 13:09:56) [GCC 4.4.3] on linux2 Type "help", "copyright", > "credits" or "license" for more information. >>>> import urllib, urllib2 >>>> urllib.urlopen('/etc/passwd').readlines() > ['root:x:0:0:root:/root:/bin/bash\n', (...) > ,'usbmux:x:109:46:usbmux daemon,,,:/home/usbmux:/bin/false\n'] >>>> urllib2.urlopen('file:///etc/passwd').readlines() > ['root:x:0:0:root:/root:/bin/bash\n', (...) What would be the best / most safe verification? Check for "http" in the beginning of the string? Or is there a good way to prevent urllib from allowing such accesses? I would never ever trust my own input at all... ;)) An can only cite DNA here: "To summarize the summary of the summary: 'People are a problem'"... ;))) And to be quite honest, the fact of having (python) standard libraries that are more general than I (could ever) think, is one of those things that amaze me every time... :) (makes me somehow happy not to be the only one... ;) Greetings

Hello, At Monday 12 September 2011 13:41:09 DaB. wrote: to prevent something like "../../dab/text.xml" as parameter with would result in "/home/drtrigon/xslt/"../../dab/text.xml" which would result to "/home/dab/text.xml" Sincerly, DaB. -- Userpage: [[:w:de:User:DaB.]] — PGP: 2B255885

Hello, At Monday 12 September 2011 14:21:05 DaB. wrote: which is true. There is no text.xml-file in my home. It was just an example. Sincerly, DaB. -- Userpage: [[:w:de:User:DaB.]] — PGP: 2B255885

On 12 September 2011 16:00, Dr. Trigon &lt;dr.trigon(a)surfeu.ch&gt; wrote: Interesting theory, but not true: valhallasw@nightshade:~$ cat > test.file blah valhallasw@nightshade:~$ python Python 2.7.1 (r271:86832, Jan 4 2011, 13:57:14) [GCC 4.5.2] on sunos5 Type "help", "copyright", "credits" or "license" for more information. ['blah\n'] Please always double-check these things in security-related issues. Best, Merlijn

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Just for information: no it is not! The following works: (this could be an issue for other homebrew bots blindly count on the framework... may be... ;) I considered this solution, since it sounded to be very easy. BUT the check for alphanum does exclude all files with '-' or '_'. Thus I decided to use my proposal. As far as I can see this does protect from '../' and '\0' in the path of the xslt file also - but please correct me if I am wrong here (and you have a scenario where this breaks down). So I implemented a list and check the first chars from url string against this list in order to be sure nothing bad goes on here. The full code (for python-gurus) is given here: ######################################## # security # check url not to point to a local file on the server, e.g. 'file://' s1 = False for item in ['http://', 'https://']: s1 = s1 or (url[:len(item)] == item) # check xslt does point to allowed local files on the server (the # '.xslt' in same directory as script) and not any other, e.g. '../' import os allowed = [item for item in os.listdir('.') if '.xslt' in item] s2 = (xslt in allowed) secure = s1 and s2 ######################################## if secure=False the default starting page will be displayed, as if nothing happened (which is actually the case). Can somebody (may be DaB) confirm if this is ok? Or still to weak? Thanks a lot for all your help, hints and participation!! Greetings to all! DrTrigon

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Am 14.09.2011 00:08, schrieb Platonides: Because you mentioned alphanumeric I thought of using "str.isalnum()" but there no additional chars can be added (as far as I know). Thus I would have to consider regex - but then I was so lazy to use my first idea... ;) But of course you are right! :) "is always safer" is good news to me and because "it is bothersome" I chosed a way somewhere in between... :) (or may be because - as mentioned - it was my first idea... ;)) Greetings and thanks for the feedback - was very helpful!