revi-archive/phorge-phorge
1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-12-15 10:00:55 +01:00
Code Issues Releases Wiki Activity

(stable) Pass SSH wrappers to VCS commands unconditonally, not just if there's an SSH remote

Browse source 
Summary:
Ref T12961. In Mercurial, it's possible to have "subrepos" which may use a different protocol than the main repository.

By putting an SSH repository inside an HTTP repository, an attacker can theoretically get us to execute `hg` without overriding `ui.ssh`, then execute code via the SSH hostname attack.

As an immediate mitigation to this attack, specify `ui.ssh` unconditionally. Normally, this will have no effect (it will just be ignored). In the specific case of an SSH repo inside an HTTP repo, it will defuse the `ssh` protocol.

For good measure and consistency, do the same for Subversion and Git. However, we don't normally maintain working copies for either Subversion or Git so it's unlikely that similar attacks exist there.

Test Plan:
  - Put an SSH subrepo with an attack URI inside an HTTP outer repo in Mercurial.
  - Ran `hg up` with and without `ui.ssh` specified.
  - Got dangerous badness without `ui.ssh` and safe `ssh` subprocesses with `ui.ssh`.

I'm not yet able to confirm that `hg pull -u -- <uri>` can actually trigger this, but this can't hurt and our SSH wrapper is safer than the native behavior for all Subversion, Git and Mercurial versions released prior to today.

Reviewers: chad

Reviewed By: chad

Subscribers: cspeckmim

Maniphest Tasks: T12961

Differential Revision: https://secure.phabricator.com/D18389
This commit is contained in:
epriestley 2017-08-10 17:04:11 -07:00
parent e0970a7e3d
commit 77e4e6fdb4
4 changed files with 12 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/applications/diffusion/protocol/DiffusionGitCommandEngine.php
View file

@ -26,9 +26,7 @@ final class DiffusionGitCommandEngine
$env['HOME'] = PhabricatorEnv::getEmptyCWD();
if ($this->isAnySSHProtocol()) {
$env['GIT_SSH'] = $this->getSSHWrapper();
}
$env['GIT_SSH'] = $this->getSSHWrapper();
if ($this->isAnyHTTPProtocol()) {
$uri = $this->getURI();

14
src/applications/diffusion/protocol/DiffusionMercurialCommandEngine.php
View file

@ -11,12 +11,14 @@ final class DiffusionMercurialCommandEngine
protected function newFormattedCommand($pattern, array $argv) {
$args = array();
if ($this->isAnySSHProtocol()) {
$pattern = "hg --config ui.ssh=%s {$pattern}";
$args[] = $this->getSSHWrapper();
} else {
$pattern = "hg {$pattern}";
}
// NOTE: Here, and in Git and Subversion, we override the SSH command even
// if the repository does not use an SSH remote, since our SSH wrapper
// defuses an attack against older versions of Mercurial, Git and
// Subversion (see T12961) and it's possible to execute this attack
// in indirect ways, like by using an SSH subrepo inside an HTTP repo.
$pattern = "hg --config ui.ssh=%s {$pattern}";
$args[] = $this->getSSHWrapper();
return array($pattern, array_merge($args, $argv));
}

4
src/applications/diffusion/protocol/DiffusionSubversionCommandEngine.php
View file

@ -44,9 +44,7 @@ final class DiffusionSubversionCommandEngine
protected function newCustomEnvironment() {
$env = array();
if ($this->isAnySSHProtocol()) {
$env['SVN_SSH'] = $this->getSSHWrapper();
}
$env['SVN_SSH'] = $this->getSSHWrapper();
return $env;
}

4
src/applications/diffusion/protocol/__tests__/DiffusionCommandEngineTestCase.php
View file

@ -26,7 +26,7 @@ final class DiffusionCommandEngineTestCase extends PhabricatorTestCase {
));
$this->assertCommandEngineFormat(
'hg xyz',
(string)csprintf('hg --config ui.ssh=%s xyz', $ssh_wrapper),
array(
'LANG' => 'en_US.UTF-8',
'HGPLAIN' => '1',
@ -102,7 +102,7 @@ final class DiffusionCommandEngineTestCase extends PhabricatorTestCase {
));
$this->assertCommandEngineFormat(
'hg xyz',
(string)csprintf('hg --config ui.ssh=%s xyz', $ssh_wrapper),
array(
'LANG' => 'en_US.UTF-8',
'HGPLAIN' => '1',