From 15639f5b1aa607ccb4fec1a41643a3b916e0e44a Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Thu, 29 Jun 2017 10:48:35 +0200 Subject: webserver: refuse to follow symlink when serving ACME challenge responses. --- webserver | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'webserver') diff --git a/webserver b/webserver index 7914762..21486ae 100755 --- a/webserver +++ b/webserver @@ -91,7 +91,11 @@ while (1) { while (defined (my $h = $conn->getline())) { last if $h eq "\r\n" }; my ($status_line, $content_type, $content); - if ($req =~ /\A\Q$ROOT\E\/([A-Za-z0-9_\-]+)\z/ and -f $1) { + if ($req =~ /\A\Q$ROOT\E\/([A-Za-z0-9_\-]+)\z/ and + ! -l $1 and -f _) { # reuse previous stat structure and save a syscall + # XXX calling lstat(2) before open(2) is racy; if O_NOFOLLOW was + # exposed to perl we would instead use it and later fstat(2) the + # file descriptor if (open my $fh, '<', $1) { # only open files in the cwd ($status_line, $content_type) = ('200 OK', 'application/jose+json'); $content = do { local $/ = undef; $fh->getline() }; -- cgit v1.2.3