Comments (5)
Haskell の process 1.6.19.0 の変更点はここのようです。
haskell/process@3c419f9
(私にはよく読めませんが・・・)
from gauche.
同じ問題を確認しました。fix中。
from gauche.
Tried to make it work, but it's pretty much hopeless. When cmd.exe
parses the command line arguments to pass them to the batch file, it employes totally different strategy from C runtime; backslashes doesn't escape double-quotes. Instead, ^
can be used to escape. But when the arguments are broken up and passed as batch file's %0
, %1
, etc., it is generally passed to another command in the batch file, and they're subject to be parsed again.
We conclude it is a waste of time to try to accomodate with this broken design. When sys-exec
etc. is invoked to run a batch file, we check the arguments and raise an error if they contain unsafe characters.
from gauche.
本件ですが、元情報は、
https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/
のようです。
そこから、
https://kb.cert.org/vuls/id/123335
へとつながり、さらに、
CVE-2024-1874
CVE-2024-22423
CVE-2024-24576
CVE-2024-3566
および、各言語のセキュリティ情報へとリンクしています。
元情報を呼んだ感じでは、(1) .bat ファイルだけでなく、
(2) .cmd ファイルを実行した場合
(3) 拡張子のないファイル X を指定したが、ディレクトリに X.bat もしくは X.cmd が存在した場合
についても、cmd.exe 経由で実行されるようです。
ただ、CreateProcess() の動作がそうなっているという話であり、
マニュアルに、「この手続きは、内部で CreateProcess() を使用しているため、
cmd.exe が暗黙的に呼ばれることによるコマンドインジェクションに注意してください。」
と記載しても良いような気もします。
((1) の対応については、あやしい文字があれば実行せずにエラーにするのは、良い判断だと思います)
from gauche.
ありがとうございます。.cmd
ファイルへの対策も必要ですね。
GaucheではCreateProcessを呼ぶ前にプログラムファイルの存在確認をしているので、引数のクオート処理の時点では拡張子は判明してます。なので(3)のケースは除外できます。
from gauche.
Related Issues (20)
- Efficient parameterizaton of ScmNumberFormat through ScmWriteControls
- Hide sensitive info from `-V` output HOT 3
- Security implication of `COMPILE_R7RS` HOT 3
- ffitest error on Fedora 40
- Better handling of `slibcat` generation when `DESTDIR` is set
- MbedTLS 3.6.0 doesn't work with Gauche HOT 4
- Running gosh during document installation hinders installing to `DESTDIR`
- idea: Convenience accessor of aggregate objects, like `let-hash` in Gerbil
- Strange behavior of text.tr when spec contains backslash HOT 2
- Rescue mode
- Call to pprint via `%W` from `Scm_Vprintf` sometimes doesn't work HOT 1
- idea: Non-advertised slots
- Printing circular data invoving hashtables
- Finish identifier macro support
- Refactor macro expander calls
- `syntax-parameterize` - swapping transformers isn't eoungh HOT 1
- Macro defining macro failure case
- Evaluate macro transformer with local env HOT 2
- Module `#<module gauche>` exports REPL-specific bindings `*1` etc.
- Support srfi-147 HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from gauche.