diff options
| author | sebres <serg.brester@sebres.de> | 2017-03-13 20:45:35 +0100 |
|---|---|---|
| committer | sebres <serg.brester@sebres.de> | 2017-03-13 20:45:35 +0100 |
| commit | 5030e3a1228265638460fcf7ffe2385dacfd5d30 (patch) | |
| tree | a4a3bbe875e632269ebb9a395293e298183dfe9a /fail2ban/helpers.py | |
| parent | c1da6611ecfdc4cf86597f614b7b5f0d780b4ab1 (diff) | |
| download | fail2ban-5030e3a1228265638460fcf7ffe2385dacfd5d30.tar.gz | |
[Important] Prohibit replacement of recursive "tags" in the action info resp. calling map (very bad idea to do this):
- the calling map contains normally dynamic values only (no recursive tags);
- recursive replacement can be vulnerable, because can contain foreign (user) input captured from log (will be replaced in the shell arguments);
Diffstat (limited to 'fail2ban/helpers.py')
| -rw-r--r-- | fail2ban/helpers.py | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/fail2ban/helpers.py b/fail2ban/helpers.py index 726631a6..de26dbcd 100644 --- a/fail2ban/helpers.py +++ b/fail2ban/helpers.py @@ -240,7 +240,7 @@ def substituteRecursiveTags(inptags, conditional='', # init: ignore = set(ignore) done = set() - calmap = hasattr(tags, "getRawItem") + noRecRepl = hasattr(tags, "getRawItem") # repeat substitution while embedded-recursive (repFlag is True) while True: repFlag = False @@ -249,7 +249,7 @@ def substituteRecursiveTags(inptags, conditional='', # ignore escaped or already done (or in ignore list): if tag in ignore or tag in done: continue # ignore replacing callable items from calling map - should be converted on demand only (by get): - if calmap and callable(tags.getRawItem(tag)): continue + if noRecRepl and callable(tags.getRawItem(tag)): continue value = orgval = str(tags[tag]) # search and replace all tags within value, that can be interpolated using other tags: m = tre_search(value) @@ -284,6 +284,8 @@ def substituteRecursiveTags(inptags, conditional='', # constructs like <STDIN>. m = tre_search(value, m.end()) continue + # if calling map - be sure we've string: + if noRecRepl: repl = str(repl) value = value.replace('<%s>' % rtag, repl) #logSys.log(5, 'value now: %s' % value) # increment reference count: |