From nobody Mon Jul 28 15:30:15 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4brMqX2lxzz63C9P; Mon, 28 Jul 2025 15:30:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4brMqW1dRdz3RYg; Mon, 28 Jul 2025 15:30:15 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1753716616; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=55H0+9HvDvKVVe3U7Rh9hh4tIwReUrODWC+2KrtWcvA=; b=t+Vm/SAFddT7jJsZdSyAOoBSvnsLg2wrfykgOp2l6wFusoTDC48562yG1lku7ina87OpFI ceo7GomjxRfsEXNMwh2DogBI90XcbTbGO52CuDYtQtkKGpF1jgyJd3kox76CYYqwinPBJ3 FkYdFRx7ACt4v84y5UqKMRTOPWfq+IxDCssHjvFJBIHHPdKfLdSHYP/duKx9kXx5NbXyyu K7LkGIA/nSaCCiEvl3GxW+43G+Up/+fyK78KxDHjt5T6x7HqUCY7KmZjJID6PkTCJiTWVe 0LtNUugDcn5/qJZffXGL+qVdNInDPAs2ng94YZReddZVyVxxVL25WZqGuVM1gQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1753716615; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=55H0+9HvDvKVVe3U7Rh9hh4tIwReUrODWC+2KrtWcvA=; b=hJLDu2CrJgvlkpvjWEnapzeM/a6zqceIRRh1LCXDiGNY1HNAmweGb7Z3sunUkeLk2tCEa8 lAPkiLZ1S8pwfX2gt9N2q+C381qpeXW4Ly16f6ELrG9KN2HBopO38Mh192686kBiQw7wfz 7w3YztogXSlE1o25mLDMdhJgDPv1UIbIp9lNzgqKI50x8uFp/iGC5SK0u/ZM2OGdpZLJrb 1gkv1n4+eMyQoxxdNybfA9AFLbtsWgiRP0tXi/pFcz8Li2NzBMnGMqusNazsFYZnQy2W+x r3BccWW4JzRCa0oLVHJq4A8asTjPw5dgutY8hcH24Dj+c1xYUxkxd8tDz3D2ng== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1753716615; a=rsa-sha256; cv=none; b=EzjRi4+zHfMnhBtpDoAzxxyK4Ewqd8uv2545V8ntiWSGYqOadrPueRG2PWr+xsEacF6nrg Eabhao61ROBVNysZHuv2wS3+vZJ1lnaQKYLLe74Z2hazzy2ubWOIyV1ZjQXtPGE96pD6u+ KUYx1oxjYb0dbmekmAr4Fie52oKp0mX6RmRv4tQG0tg9MCYlrQFJjCvya+ipDepR924rpl 9ljyc6ZLbvPExDugztQuVaKVdH1fNKeTfVJkzIAL3GMqE2F6IJ8g9jHbJAyF5W2J/69nzj HeWxUBC0C9T+Z9jER399h6OnlCJeJndCpnS/gJ0XWqeqWyvvR2e0WhgITzDVFw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4brMqW159hzr1d; Mon, 28 Jul 2025 15:30:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 56SFUFmc004763; Mon, 28 Jul 2025 15:30:15 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 56SFUFYC004755; Mon, 28 Jul 2025 15:30:15 GMT (envelope-from git) Date: Mon, 28 Jul 2025 15:30:15 GMT Message-Id: <202507281530.56SFUFYC004755@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Dag-Erling =?utf-8?Q?Sm=C3=B8rgrav?= Subject: git: 4a4338d94401 - main - comsat: Don't read arbitrary files List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: des X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 4a4338d94401f0012380d4f1a4d332bd6d44fa8e Auto-Submitted: auto-generated The branch main has been updated by des: URL: https://cgit.FreeBSD.org/src/commit/?id=4a4338d94401f0012380d4f1a4d332bd6d44fa8e commit 4a4338d94401f0012380d4f1a4d332bd6d44fa8e Author: Dag-Erling Smørgrav AuthorDate: 2025-07-28 15:28:26 +0000 Commit: Dag-Erling Smørgrav CommitDate: 2025-07-28 15:28:59 +0000 comsat: Don't read arbitrary files When processing a notification, instead of accepting any file name that doesn't begin with a slash, accept only file names that don't contain any slashes at all. This makes it possible to notify a user about a mailbox that doesn't bear their name, as long as they are permitted to read it, but prevents comsat from reading files outside the mail spool. PR: 270404 MFC after: 1 week Reviewed by: emaste Differential Revision: https://reviews.freebsd.org/D51580 --- libexec/comsat/comsat.c | 38 +++++++++++++------------------------- 1 file changed, 13 insertions(+), 25 deletions(-) diff --git a/libexec/comsat/comsat.c b/libexec/comsat/comsat.c index d5d1eedeb5f3..60d4f65519d0 100644 --- a/libexec/comsat/comsat.c +++ b/libexec/comsat/comsat.c @@ -113,29 +113,24 @@ mailfor(char *name) char *file; off_t offset; int folder; - char buf[sizeof(_PATH_MAILDIR) + sizeof(utp->ut_user) + 1]; - char buf2[sizeof(_PATH_MAILDIR) + sizeof(utp->ut_user) + 1]; + char buf[MAXPATHLEN]; - if (!(cp = strchr(name, '@'))) + if ((cp = strchr(name, '@')) == NULL) return; *cp = '\0'; offset = strtoll(cp + 1, NULL, 10); - if (!(cp = strchr(cp + 1, ':'))) - file = name; - else - file = cp + 1; - sprintf(buf, "%s/%.*s", _PATH_MAILDIR, (int)sizeof(utp->ut_user), - name); - if (*file != '/') { - sprintf(buf2, "%s/%.*s", _PATH_MAILDIR, - (int)sizeof(utp->ut_user), file); - file = buf2; + if ((cp = strchr(cp + 1, ':')) != NULL && + strchr((file = cp + 1), '/') == NULL) { + snprintf(buf, sizeof(buf), "%s/%s", _PATH_MAILDIR, file); + folder = 1; + } else { + snprintf(buf, sizeof(buf), "%s/%s", _PATH_MAILDIR, name); + folder = 0; } - folder = strcmp(buf, file); setutxent(); while ((utp = getutxent()) != NULL) if (utp->ut_type == USER_PROCESS && !strcmp(utp->ut_user, name)) - notify(utp, file, offset, folder); + notify(utp, buf, offset, folder); endutxent(); } @@ -159,8 +154,7 @@ notify(struct utmpx *utp, char file[], off_t offset, int folder) utp->ut_line); return; } - (void)snprintf(tty, sizeof(tty), "%s%.*s", - _PATH_DEV, (int)sizeof(utp->ut_line), utp->ut_line); + (void)snprintf(tty, sizeof(tty), "%s%s", _PATH_DEV, utp->ut_line); if (stat(tty, &stb) == -1 || !(stb.st_mode & (S_IXUSR | S_IXGRP))) { dsyslog(LOG_DEBUG, "%s: wrong mode on %s", utp->ut_user, tty); return; @@ -189,24 +183,18 @@ notify(struct utmpx *utp, char file[], off_t offset, int folder) setuid(p->pw_uid) == -1) return; - switch (stb.st_mode & (S_IXUSR | S_IXGRP)) { - case S_IXUSR: - case (S_IXUSR | S_IXGRP): + if (stb.st_mode & S_IXUSR) { (void)fprintf(tp, "%s\007New mail for %s@%.*s\007 has arrived%s%s%s:%s----%s", cr, utp->ut_user, (int)sizeof(hostname), hostname, folder ? cr : "", folder ? "to " : "", folder ? file : "", cr, cr); jkfprintf(tp, file, offset); - break; - case S_IXGRP: + } else if (stb.st_mode & S_IXGRP) { (void)fprintf(tp, "\007"); (void)fflush(tp); (void)sleep(1); (void)fprintf(tp, "\007"); - break; - default: - break; } (void)fclose(tp); _exit(0);