Bugzilla – Attachment 3280 Details for
Bug 3007
Provide regression tests for scp vulnerabilities
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
Patch from sintonen.fi
file_3007.txt (text/plain), 1.57 KB, created by
Jakub Jelen
on 2019-05-10 22:29:45 AEST
(
hide
)
Description:
Patch from sintonen.fi
Filename:
MIME Type:
Creator:
Jakub Jelen
Created:
2019-05-10 22:29:45 AEST
Size:
1.57 KB
patch
obsolete
>diff --git a/regress/scp-ssh-wrapper.sh b/regress/scp-ssh-wrapper.sh >index 59f1ff63..dd48a482 100644 >--- a/regress/scp-ssh-wrapper.sh >+++ b/regress/scp-ssh-wrapper.sh >@@ -51,6 +51,18 @@ badserver_4) > echo "C755 2 file" > echo "X" > ;; >+badserver_5) >+ echo "D0555 0 " >+ echo "X" >+ ;; >+badserver_6) >+ echo "D0555 0 ." >+ echo "X" >+ ;; >+badserver_7) >+ echo "C0755 2 extrafile" >+ echo "X" >+ ;; > *) > set -- $arg > shift >diff --git a/regress/scp.sh b/regress/scp.sh >index 57cc7706..104c89e1 100644 >--- a/regress/scp.sh >+++ b/regress/scp.sh >@@ -25,6 +25,7 @@ export SCP # used in scp-ssh-wrapper.scp > scpclean() { > rm -rf ${COPY} ${COPY2} ${DIR} ${DIR2} > mkdir ${DIR} ${DIR2} >+ chmod 755 ${DIR} ${DIR2} > } > > verbose "$tid: simple copy local file to local file" >@@ -101,7 +102,7 @@ if [ ! -z "$SUDO" ]; then > $SUDO rm ${DIR2}/copy > fi > >-for i in 0 1 2 3 4; do >+for i in 0 1 2 3 4 5 6 7; do > verbose "$tid: disallow bad server #$i" > SCPTESTMODE=badserver_$i > export DIR SCPTESTMODE >@@ -113,6 +114,15 @@ for i in 0 1 2 3 4; do > scpclean > $SCP -r $scpopts somehost:${DATA} ${DIR2} >/dev/null 2>/dev/null > [ -d ${DIR}/dotpathdir ] && fail "allows dir creation outside of subdir" >+ >+ scpclean >+ $SCP -pr $scpopts somehost:${DATA} ${DIR2} >/dev/null 2>/dev/null >+ [ ! -w ${DIR2} ] && fail "allows target root attribute change" >+ >+ scpclean >+ $SCP $scpopts somehost:${DATA} ${DIR2} >/dev/null 2>/dev/null >+ [ -e ${DIR2}/extrafile ] && fail "allows extranous object creation" >+ rm -f ${DIR2}/extrafile > done > > verbose "$tid: detect non-directory target"
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Actions:
View
Attachments on
bug 3007
: 3280