github/portmaster
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Resolve to real file paths before checking path based API access

Browse Source
This commit is contained in:
Daniel
2022-04-26 15:02:05 +02:00
parent 42eb3a1d0e
commit 9a39caf22b
1 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
firewall/api.go
View File

@@ -22,11 +22,7 @@ import (
) )
const ( const (
deniedMsgUnidentified = `%wFailed to identify the requesting process. deniedMsgUnidentified = `%wFailed to identify the requesting process. Reload to try again.`
You can enable the Development Mode to disable API authentication for development purposes.
If you are seeing this message in the Portmaster App, please restart the app or right-click and select "Reload".
In the future, this issue will be remediated automatically.`
deniedMsgSystem = `%wSystem access to the Portmaster API is not permitted. deniedMsgSystem = `%wSystem access to the Portmaster API is not permitted.
You can enable the Development Mode to disable API authentication for development purposes.` You can enable the Development Mode to disable API authentication for development purposes.`
@@ -136,6 +132,12 @@ func authenticateAPIRequest(ctx context.Context, pktInfo *packet.Info) (retry bo
if authenticatedPath == "" { if authenticatedPath == "" {
return false, fmt.Errorf(deniedMsgMisconfigured, api.ErrAPIAccessDeniedMessage) //nolint:stylecheck // message for user return false, fmt.Errorf(deniedMsgMisconfigured, api.ErrAPIAccessDeniedMessage) //nolint:stylecheck // message for user
} }
// Get real path.
authenticatedPath, err = filepath.EvalSymlinks(authenticatedPath)
if err != nil {
return false, fmt.Errorf(deniedMsgUnidentified, api.ErrAPIAccessDeniedMessage) //nolint:stylecheck // message for user
}
// Add filepath separator to confine to directory.
authenticatedPath += string(filepath.Separator) authenticatedPath += string(filepath.Separator)
// Get process of request. // Get process of request.
@@ -157,8 +159,10 @@ func authenticateAPIRequest(ctx context.Context, pktInfo *packet.Info) (retry bo
break checkLevelsLoop break checkLevelsLoop
default: // normal process default: // normal process
// Check if the requesting process is in database root / updates dir. // Check if the requesting process is in database root / updates dir.
if strings.HasPrefix(proc.Path, authenticatedPath) { if realPath, err := filepath.EvalSymlinks(proc.Path); err == nil {
return false, nil if strings.HasPrefix(realPath, authenticatedPath) {
return false, nil
}
} }
} }