Page MenuHomeFreeBSD

comsat: Don't read arbitrary files
ClosedPublic

Authored by des on Jul 27 2025, 7:48 PM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, Jan 16, 9:45 AM
Unknown Object (File)
Dec 11 2025, 1:04 PM
Unknown Object (File)
Dec 11 2025, 3:43 AM
Unknown Object (File)
Dec 9 2025, 6:35 AM
Unknown Object (File)
Nov 25 2025, 9:17 PM
Unknown Object (File)
Nov 20 2025, 3:20 AM
Unknown Object (File)
Nov 13 2025, 12:56 AM
Unknown Object (File)
Nov 3 2025, 1:40 AM
Subscribers

Details

Summary

When processing a notification, instead of accepting any file name
that doesn't begin with a slash, accept only file names that don't
contain any slashes at all. This makes it possible to notify a
user about a mailbox that doesn't bear their name, as long as they
are permitted to read it, but prevents comsat from reading files
outside the mail spool.

PR: 270404
MFC after: 1 week

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 65781
Build 62664: arc lint + arc unit

Event Timeline

des requested review of this revision.Jul 27 2025, 7:48 PM

Sorry, just realized this is incomplete. Will update in a bit.

Maybe we want to just discard a notification with a / in it rather than falling back to name (but I'm fine either way)

libexec/comsat/comsat.c
192

Probably worth calling out this cleanup specifically in the commit message

This revision is now accepted and ready to land.Jul 28 2025, 2:58 PM
This revision was automatically updated to reflect the committed changes.