[osm-tile-server] 01/01: Prevent injection of commands in osm-tile-server-import-raw that can be run as setuid osm-tile-server

[Ruben Undheim]

This is an automated email from the git hooks/post-receive script.

rubund-guest pushed a commit to branch master
in repository osm-tile-server.

commit bb81b11cf55c77b85d76698fbccbdf6bfcd0ed15
Author: Ruben Undheim <ruben.undheim at gmail.com>
Date:   Sat Nov 7 10:10:27 2015 +0100

    Prevent injection of commands in osm-tile-server-import-raw that can be run as setuid osm-tile-server
---
 scripts/osm-tile-server-import   |  2 +-
 src/osm-tile-server-import-raw.c | 32 +++++++++++++++++++++++++++++---
 2 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/scripts/osm-tile-server-import b/scripts/osm-tile-server-import
index 301f4aa..74cb1e6 100755
--- a/scripts/osm-tile-server-import
+++ b/scripts/osm-tile-server-import
@@ -20,7 +20,7 @@ if groups | grep -q '\bosm-tile-server\b' ; then
 fi
 
 if [ $ALLOWED = 1 ] ;then
-  /usr/lib/osm-tile-server-base/bin/osm-tile-server-import-raw $*
+  /usr/lib/osm-tile-server-base/bin/osm-tile-server-import-raw "$1"
 else
   no_permission
 fi
diff --git a/src/osm-tile-server-import-raw.c b/src/osm-tile-server-import-raw.c
index 4b03ebb..0c2c671 100644
--- a/src/osm-tile-server-import-raw.c
+++ b/src/osm-tile-server-import-raw.c
@@ -4,16 +4,40 @@
 
 #include "parse-settings.h"
 
+
+char command[512];
+
 int main(int argc, char **argv)
 {
-	char command[256];
 	char *pbffile;
 
 	if(argc != 2){
 		fprintf(stderr,"Usage: osm-tile-server-import <pbf-file>\n");
 		return -1;
 	}
-	pbffile = argv[1];
+
+	pbffile = (char*)malloc(256);
+
+	int i,p=0;
+	int pbflen = strlen(argv[1]);
+	for(i=0;i<pbflen;i++){
+		if(argv[1][i] == '\'') {
+			pbffile[p] = '\'';
+			p++;
+			pbffile[p] = '\\';
+			p++;
+			pbffile[p] = '\'';
+			p++;
+			pbffile[p] = '\'';
+		}
+		else{
+			pbffile[p] = argv[1][i];
+		}
+		p++;
+		if(p >= 255) break;
+	}
+	pbffile[p] = 0;
+	printf("pbffile '%s'",pbffile);
 
 	parse_settings();
 
@@ -23,10 +47,12 @@ int main(int argc, char **argv)
 	else {
 		cfg_slim[0] = 0;
 	}
-	snprintf(command,255,"osm2pgsql %s -d %s --cache-strategy %s -C %s --number-processes %s --hstore -S /usr/share/osm2pgsql/default.style %s",cfg_slim,cfg_dbname,cfg_cache_strategy,cfg_memory,cfg_processes,pbffile);
+	snprintf(command,255,"osm2pgsql %s -d %s --cache-strategy %s -C %s --number-processes %s --hstore -S /usr/share/osm2pgsql/default.style '%s'",cfg_slim,cfg_dbname,cfg_cache_strategy,cfg_memory,cfg_processes,pbffile);
 	printf("Importing to database with this command:\n\n");
 	printf(" %s\n\n",command);
 
+	free(pbffile);
+
 	return system(command);
 
 }

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-grass/osm-tile-server.git