Page MenuHomeFreeBSD

comsat: Don't read arbitrary files
ClosedPublic

Authored by des on Jul 27 2025, 7:48 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Nov 3, 1:40 AM
Unknown Object (File)
Mon, Nov 3, 1:32 AM
Unknown Object (File)
Mon, Nov 3, 1:32 AM
Unknown Object (File)
Mon, Nov 3, 1:29 AM
Unknown Object (File)
Mon, Nov 3, 1:29 AM
Unknown Object (File)
Wed, Oct 29, 8:17 PM
Unknown Object (File)
Sat, Oct 25, 7:07 AM
Unknown Object (File)
Mon, Oct 13, 12:12 PM
Subscribers

Details

Summary

When processing a notification, instead of accepting any file name
that doesn't begin with a slash, accept only file names that don't
contain any slashes at all. This makes it possible to notify a
user about a mailbox that doesn't bear their name, as long as they
are permitted to read it, but prevents comsat from reading files
outside the mail spool.

PR: 270404
MFC after: 1 week

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 65781
Build 62664: arc lint + arc unit

Event Timeline

des requested review of this revision.Jul 27 2025, 7:48 PM

Sorry, just realized this is incomplete. Will update in a bit.

Maybe we want to just discard a notification with a / in it rather than falling back to name (but I'm fine either way)

libexec/comsat/comsat.c
192

Probably worth calling out this cleanup specifically in the commit message

This revision is now accepted and ready to land.Jul 28 2025, 2:58 PM
This revision was automatically updated to reflect the committed changes.