From 40640215468b1fe7f7b17c299c658e94f82e7d70 Mon Sep 17 00:00:00 2001 From: Eric Windisch Date: Tue, 12 Feb 2013 01:13:17 -0500 Subject: Sanitize input before creating IPC socket. Sockets are created by the zeromq driver for the topic specified by each incoming message. Because the topic is arbitrarily supplied by the sender, path separators in the topic must be illegal. Fixes bug 1122763 Change-Id: Iccdb9b69e646bfe7665ee34c367fd4019db25f17 --- openstack/common/rpc/impl_zmq.py | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'openstack') diff --git a/openstack/common/rpc/impl_zmq.py b/openstack/common/rpc/impl_zmq.py index 7af9cd0..87f8d21 100644 --- a/openstack/common/rpc/impl_zmq.py +++ b/openstack/common/rpc/impl_zmq.py @@ -16,6 +16,7 @@ import os import pprint +import re import socket import sys import types @@ -431,6 +432,8 @@ class ZmqProxy(ZmqBaseReactor): def __init__(self, conf): super(ZmqProxy, self).__init__(conf) + pathsep = set((os.path.sep or '', os.path.altsep or '', '/', '\\')) + self.badchars = re.compile(r'[%s]' % re.escape(''.join(pathsep))) self.topic_proxy = {} @@ -456,6 +459,13 @@ class ZmqProxy(ZmqBaseReactor): LOG.info(_("Creating proxy for topic: %s"), topic) try: + # The topic is received over the network, + # don't trust this input. + if self.badchars.search(topic) is not None: + emsg = _("Topic contained dangerous characters.") + LOG.warn(emsg) + raise RPCException(emsg) + out_sock = ZmqSocket("ipc://%s/zmq_topic_%s" % (ipc_dir, topic), sock_type, bind=True) -- cgit