Project

General

Profile

Bug #20271

Safe mode rendering does not correctly prevent using symbol to proc calls

Added by Tomer Brisker over 5 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
High
Assignee:
Tomer Brisker
Category:
Security
Target version:
1.15.3
Difficulty:
Triaged:
Bugzilla link:
1469599
Pull request:
https://github.com/theforeman/community-templates/pull/411, https://github.com/theforeman/foreman/pull/4659, https://github.com/theforeman/community-templates/pull/407, https://github.com/theforeman/foreman/pull/4669
Fixed in Releases:
Found in Releases:
Red Hat JIRA:

Description

Using methods such as `.each`, a user can pass as an argument a symbol to be called, for example `.each(&:delete)`.
This allows execution of commands that should be blocked by the jail.
A fix proposal in the safemode gem has been suggested: https://github.com/svenfuchs/safemode/pull/23
Once it is merged we should update our version of the gem to the latest one.

Related issues

Copied to Katello - Bug #20836: Safe mode rendering does not correctly prevent using symbol to proc callsClosed2017-07-11

Associated revisions

Revision feb81111 (diff)
Added by Tomer Brisker over 5 years ago

Fixes #20271 - update safemode gem

Revision b1b357cf (diff)
Added by Tomer Brisker over 5 years ago

Fixes #20271 - update safemode gem

Revision 4b740d96 (diff)
Added by Tomer Brisker over 5 years ago

Fixes #20271 - update safemode gem

(cherry picked from commit feb811114bca02dd746f7b275fbf04715b43376f)

Revision 760f3a28 (diff)
Added by Marek Hulán over 5 years ago

Refs #20271 - remove to_proc syntax

History

#1 Updated by Marek Hulán over 5 years ago

  • Category changed from Templates to Security

#2 Updated by Marek Hulán over 5 years ago

This should be probably cherry-picked to all supported Foreman versions.

#3 Updated by Tomer Brisker over 5 years ago

  • Bugzilla link set to 1469599

#4 Updated by The Foreman Bot over 5 years ago

  • Status changed from New to Ready For Testing
  • Assignee set to Tomer Brisker
  • Pull request https://github.com/theforeman/foreman/pull/4659 added

#5 Updated by Daniel Lobato Garcia over 5 years ago

  • Legacy Backlogs Release (now unused) set to 276

#6 Updated by Anonymous over 5 years ago

  • Status changed from Ready For Testing to Closed
  • % Done changed from 0 to 100

#7 Updated by Alex Fisher over 5 years ago

This possibly should be reopened until https://github.com/theforeman/community-templates/issues/406 is resolved.

#8 Updated by Daniel Lobato Garcia over 5 years ago

The fix is fine, on nightly it prevents using &: . The linked GH issue with templates not being 'aware' of this fix is a different thing.

#9 Updated by The Foreman Bot over 5 years ago

  • Pull request https://github.com/theforeman/community-templates/pull/407 added

#10 Updated by The Foreman Bot over 5 years ago

  • Pull request https://github.com/theforeman/foreman/pull/4669 added

#11 Updated by The Foreman Bot over 5 years ago

  • Pull request https://github.com/theforeman/community-templates/pull/411 added

#12 Updated by Marek Hulán over 5 years ago

  • Copied to Bug #20836: Safe mode rendering does not correctly prevent using symbol to proc calls added

Also available in: Atom PDF