← Back to branch summary

~azzar1/unity/add-show-desktop-key

« back to all changes in this revision

Viewing changes to ivle/database.py

  • Committer: Matt Giuca
  • Date: 2010-02-23 04:16:34 UTC
  • Revision ID: matt.giuca@gmail.com-20100223041634-lhi0fg68iwe4ov1d
https://launchpad.net/bugs/522462
ivle.database: Added a security check on Project.submit() that the path meets certain constraints, to avoid path injection. Fixes LP bug #522462.

Show diffs side-by-side

added added

removed removed

Lines of Context:
ivle/database.py
25
25
 
26
26
import hashlib
27
27
import datetime
 
28
import os
28
29
 
29
30
from storm.locals import create_database, Store, Int, Unicode, DateTime, \
30
31
                         Reference, ReferenceSet, Bool, Storm, Desc
607
608
 
608
609
        a = Assessed.get(Store.of(self), principal, self)
609
610
        ps = ProjectSubmission()
610
 
        ps.path = path
 
611
        # Raise SubmissionError if the path is illegal
 
612
        ps.path = ProjectSubmission.test_and_normalise_path(path)
611
613
        ps.revision = revision
612
614
        ps.date_submitted = datetime.datetime.now()
613
615
        ps.assessed = a
813
815
    approver = Reference(approver_id, User.id)
814
816
    notes = Unicode()
815
817
 
 
818
class SubmissionError(Exception):
 
819
    """Denotes a validation error during submission."""
 
820
    pass
 
821
 
816
822
class ProjectSubmission(Storm):
817
823
    """A submission from a user or group repository to a particular project.
818
824
 
848
854
        return "/files/%s/%s/%s?r=%d" % (user.login,
849
855
            self.assessed.checkout_location, submitpath, self.revision)
850
856
 
 
857
    @staticmethod
 
858
    def test_and_normalise_path(path):
 
859
        """Test that path is valid, and normalise it. This prevents possible
 
860
        injections using malicious paths.
 
861
        Returns the updated path, if successful.
 
862
        Raises SubmissionError if invalid.
 
863
        """
 
864
        # Ensure the path is absolute to prevent being tacked onto working
 
865
        # directories.
 
866
        # Prevent '\n' because it will break all sorts of things.
 
867
        # Prevent '[' and ']' because they can be used to inject into the
 
868
        # svn.conf.
 
869
        # Normalise to avoid resulting in ".." path segments.
 
870
        if not os.path.isabs(path):
 
871
            raise SubmissionError("Path is not absolute")
 
872
        if any(c in path for c in "\n[]"):
 
873
            raise SubmissionError("Path must not contain '\\n', '[' or ']'")
 
874
        return os.path.normpath(path)
 
875
 
851
876
# WORKSHEETS AND EXERCISES #
852
877
 
853
878
class Exercise(Storm):