Print this page 
12585 insufficient validation in svccfg for service name
Split Close
Expand all
Collapse all
          --- old/usr/src/cmd/svc/svccfg/svccfg_xml.c
          +++ new/usr/src/cmd/svc/svccfg/svccfg_xml.c
↓ open down ↓ 15 lines elided ↑ open up ↑ 
  16   16   * fields enclosed by brackets "[]" replaced with your own identifying
  17   17   * information: Portions Copyright [yyyy] [name of copyright owner]
  18   18   *
  19   19   * CDDL HEADER END
  20   20   */
  21   21  /*
  22   22   * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
  23   23   */
  24   24  /*
  25   25   * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  26      - * Copyright 2019 Joyent, Inc.
       26 + * Copyright 2020 Joyent, Inc.
  27   27   */
  28   28  
  29   29  
  30   30  /*
  31   31   * XML document manipulation routines
  32   32   *
  33   33   * These routines provide translation to and from the internal representation to
  34   34   * XML.  Directionally-oriented verbs are with respect to the external source,
  35   35   * so lxml_get_service() fetches a service from the XML file into the
  36   36   * internal representation.
↓ open down ↓ 3360 lines elided ↑ open up ↑ 
3397 3397  out:
3398 3398          scf_pg_destroy(pg);
3399 3399          scf_service_destroy(svc);
3400 3400          scf_scope_destroy(sc);
3401 3401          scf_handle_destroy(h);
3402 3402  
3403 3403          return (rc);
3404 3404  }
3405 3405  
3406 3406  /*
     3407 + * Validate the svc:/-prefixed FMRI generated from the service name.
     3408 + */
     3409 +static void
     3410 +validate_service_name(const entity_t *s)
     3411 +{
     3412 +        char *fmri;
     3413 +        int ftype;
     3414 +        const char *finst;
     3415 +
     3416 +        if ((fmri = uu_strdup(s->sc_fmri)) == NULL)
     3417 +                uu_die(gettext("couldn't allocate memory"));
     3418 +
     3419 +        if (scf_parse_fmri(fmri, &ftype, NULL, NULL, &finst, NULL, NULL) != 0 ||
     3420 +            finst != NULL || ftype != SCF_FMRI_TYPE_SVC) {
     3421 +                uu_die(gettext("invalid value \"%s\": should be a bare "
     3422 +                    "service name\n"), s->sc_name);
     3423 +        }
     3424 +
     3425 +        uu_free(fmri);
     3426 +}
     3427 +
     3428 +/*
3407 3429   * Translate a service element into an internal instance/property tree, added
3408 3430   * to bundle.
3409 3431   *
3410 3432   * If op is SVCCFG_OP_APPLY (i.e., apply a profile), do not allow for
3411 3433   * modification of template data.
3412 3434   */
3413 3435  static int
3414 3436  lxml_get_service(bundle_t *bundle, xmlNodePtr svc, svccfg_op_t op)
3415 3437  {
3416 3438          pgroup_t *pg;
↓ open down ↓ 3 lines elided ↑ open up ↑ 
3420 3442          xmlChar *type;
3421 3443          xmlChar *version;
3422 3444          int e;
3423 3445  
3424 3446          /*
3425 3447           * Fetch attributes, as appropriate.
3426 3448           */
3427 3449          s = internal_service_new((char *)xmlGetProp(svc,
3428 3450              (xmlChar *)name_attr));
3429 3451  
     3452 +        validate_service_name(s);
     3453 +
3430 3454          version = xmlGetProp(svc, (xmlChar *)version_attr);
3431 3455          s->sc_u.sc_service.sc_service_version = atol((const char *)version);
3432 3456          xmlFree(version);
3433 3457  
3434 3458          type = xmlGetProp(svc, (xmlChar *)type_attr);
3435 3459          s->sc_u.sc_service.sc_service_type = lxml_xlate_service_type(type);
3436 3460          xmlFree(type);
3437 3461  
3438 3462          /*
3439 3463           * Set the global missing type to false before processing the service
↓ open down ↓ 396 lines elided ↑ open up ↑ 
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX