Page MenuHomeFreeBSD

comsat: Don't read arbitrary files
ClosedPublic

Authored by des on Jul 27 2025, 7:48 PM.
Tags
None
Referenced Files
F151663682: D51580.id159331.diff
Thu, Apr 9, 8:56 PM
F151637003: D51580.id159331.diff
Thu, Apr 9, 4:38 PM
Unknown Object (File)
Mon, Apr 6, 7:41 AM
Unknown Object (File)
Sun, Mar 29, 1:00 AM
Unknown Object (File)
Tue, Mar 24, 7:15 PM
Unknown Object (File)
Mar 5 2026, 3:30 PM
Unknown Object (File)
Feb 24 2026, 4:42 PM
Unknown Object (File)
Feb 24 2026, 8:33 AM
Subscribers

Details

Summary

When processing a notification, instead of accepting any file name
that doesn't begin with a slash, accept only file names that don't
contain any slashes at all. This makes it possible to notify a
user about a mailbox that doesn't bear their name, as long as they
are permitted to read it, but prevents comsat from reading files
outside the mail spool.

PR: 270404
MFC after: 1 week

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 65781
Build 62664: arc lint + arc unit

Event Timeline

des requested review of this revision.Jul 27 2025, 7:48 PM

Sorry, just realized this is incomplete. Will update in a bit.

Maybe we want to just discard a notification with a / in it rather than falling back to name (but I'm fine either way)

libexec/comsat/comsat.c
192

Probably worth calling out this cleanup specifically in the commit message

This revision is now accepted and ready to land.Jul 28 2025, 2:58 PM
This revision was automatically updated to reflect the committed changes.