diff options
| author | Jo-Philipp Wich <jo@mein.io> | 2022-01-19 16:32:52 +0100 |
|---|---|---|
| committer | Jo-Philipp Wich <jo@mein.io> | 2022-01-19 16:34:21 +0100 |
| commit | cc8ba6e3010ba58fb188eacb93af43fc05f11791 (patch) | |
| tree | 59ae59bda086b8a8834b249848e0e85f1f6c3199 | |
| parent | 6f349c9142e436d6c7447c0a2ab108803ba431f8 (diff) | |
luci-base: sys: prevent path traversal via sys.init routines
Filter the init script name parameter through fs.basename() to avoid
invoking paths outside of /etc/init.d/.
Reported-by: Graham R <gr348@cam.ac.uk>
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 8752701b0d01a81d0bd0a735be733f24ad11ab69)
| -rw-r--r-- | modules/luci-base/luasrc/sys.lua | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/modules/luci-base/luasrc/sys.lua b/modules/luci-base/luasrc/sys.lua index bf21b5f191..bfbd6f2fe6 100644 --- a/modules/luci-base/luasrc/sys.lua +++ b/modules/luci-base/luasrc/sys.lua @@ -566,6 +566,7 @@ function init.names() end function init.index(name) + name = fs.basename(name) if fs.access(init.dir..name) then return call("env -i sh -c 'source %s%s enabled; exit ${START:-255}' >/dev/null" %{ init.dir, name }) @@ -573,6 +574,7 @@ function init.index(name) end local function init_action(action, name) + name = fs.basename(name) if fs.access(init.dir..name) then return call("env -i %s%s %s >/dev/null" %{ init.dir, name, action }) end |