{"thread":{"id":"51609","subject":"Windows absolute drive path detection incomplete","startedAt":"2019-08-08T16:44:59Z","lastAt":"2019-08-09T00:22:56Z","messageCount":4,"participants":["Christopher Ertl","Eric Sunshine","brian m. carlson"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"380144","messageId":"DB7PR83MB0268816EF2F435EF791272C197D70@DB7PR83MB0268.EURPRD83.prod.outlook.com","threadId":"51609","inReplyTo":null,"subject":"Windows absolute drive path detection incomplete","fromName":"Christopher Ertl","fromEmail":"christopher.ertl@microsoft.com","sentAt":"2019-08-08T16:44:52Z","receivedAt":"2019-08-08T16:44:59Z","isPatch":false,"sender":{"key":"christopher.ertl@microsoft.com","avatar":null},"body":"Hi,\n\nI'd like to report a problem with path validation for Windows, and propose a fix.\n\nFunction `verify_path` first calls `has_dos_drive_prefix` in order to prevent absolute drive paths like \"C:\\xxx\". The logic for that is implemented as follows:\n\n#define has_dos_drive_prefix(path) \\\n\t(isalpha(*(path)) && (path)[1] == ':' ? 2 : 0)\n\n\nThe problem is that Windows will still interpret a path like this as an absolute drive path even if the first character isn't alpha, and so it should still be rejected.\n\nIn fact, it's actually possible to create drives like that which bypass this filter on Windows (as Administrator), even if it's not an officially supported feature:\n\n>subst 1: C:\\Users\\x\\Desktop\n\n>dir 1:\n...\n\n Directory of 1:\\\n\n08/06/2019 06:19 PM .\n08/06/2019 06:19 PM ..\n...\n\n\nWith a drive like this present, a malicious server can write to wherever that drive points when you perform a git clone (to test this, just create a git repository containing :1/file):\n\n>git clone http://x/pathtest\nCloning into 'pathtest'...\n\n\n>dir pathtest\n...\n Directory of pathtest\n\n08/08/2019 04:49 PM .\n08/08/2019 04:49 PM ..\n 0 File(s) 0 bytes\n\n\n>dir C:\\Users\\x\\Desktop\n...\n Directory of C:\\Users\\x\\Desktop\n\n08/08/2019 04:49 PM 9 file\n\n\nIf the drive doesn't exist, the clone will fail anyway:\n\n>dir 1:\nThe system cannot find the path specified.\n\n>git clone http://x/pathtest\nCloning into 'pathtest'...\nfatal: cannot create directory at '1:': No such file or directory\nwarning: Clone succeeded, but checkout failed.\nYou can inspect what was checked out with 'git status'\nand retry the checkout with 'git checkout -f HEAD'\n\n\nSo I'm proposing to remove the check for the drive letter being alpha in `has_dos_drive_prefix` macro:\n\n#define has_dos_drive_prefix(path) \\\n\t( (path)[1] == ':' ? 2 : 0)\n\n\nAs well as being a security patch for RCE under very unlikely circumstance, this patch is also a micro performance boost!\n\nThanks,\n\nChristopher Ertl | MSRC Vulnerabilities & Mitigations | Microsoft Limited \nMicrosoft Limited (company number 01624297) is a company registered in England and Wales whose registered office is at Microsoft Campus, Thames Valley Park, Reading. RG6 1WG\n\n"},{"id":"380145","messageId":"CAPig+cSuj6xWjYuQtuiuNQwroqO8sEh4iAGgLqQVOLQr8CMpDQ@mail.gmail.com","threadId":"51609","inReplyTo":"DB7PR83MB0268816EF2F435EF791272C197D70@DB7PR83MB0268.EURPRD83.prod.outlook.com","subject":"Re: Windows absolute drive path detection incomplete","fromName":"Eric Sunshine","fromEmail":"sunshine@sunshineco.com","sentAt":"2019-08-08T16:50:32Z","receivedAt":"2019-08-08T16:50:46Z","isPatch":false,"sender":{"key":"sunshine@sunshineco.com","avatar":"https://avatars.githubusercontent.com/u/163641?v=4"},"body":"On Thu, Aug 8, 2019 at 12:45 PM Christopher Ertl\n wrote:\n> So I'm proposing to remove the check for the drive letter being alpha in `has_dos_drive_prefix` macro:\n>\n> #define has_dos_drive_prefix(path) \\\n> ( (path)[1] == ':' ? 2 : 0)\n\nNit: This isn't safe and will access memory beyond end-of-string if\npath is zero-length. Perhaps something like this would be better:\n\n #define has_dos_drive_prefix(path) \\\n (*(path) && (path)[1] == ':' ? 2 : 0)\n"},{"id":"380147","messageId":"DB7PR83MB02682420A7444A60F8C9453997D70@DB7PR83MB0268.EURPRD83.prod.outlook.com","threadId":"51609","inReplyTo":"CAPig+cSuj6xWjYuQtuiuNQwroqO8sEh4iAGgLqQVOLQr8CMpDQ@mail.gmail.com","subject":"RE: Windows absolute drive path detection incomplete","fromName":"Christopher Ertl","fromEmail":"christopher.ertl@microsoft.com","sentAt":"2019-08-08T16:58:27Z","receivedAt":"2019-08-08T16:58:32Z","isPatch":false,"sender":{"key":"christopher.ertl@microsoft.com","avatar":null},"body":"Thanks, Eric, you're absolutely right; good spot!\n\nChristopher Ertl | MSRC Vulnerabilities & Mitigations | Microsoft Limited \nMicrosoft Limited (company number 01624297) is a company registered in England and Wales whose registered office is at Microsoft Campus, Thames Valley Park, Reading. RG6 1WG\n\n-----Original Message-----\nFrom: Eric Sunshine \nSent: Thursday, August 8, 2019 5:51 PM\nTo: Christopher Ertl \nCc: git@vger.kernel.org\nSubject: Re: Windows absolute drive path detection incomplete\n\nOn Thu, Aug 8, 2019 at 12:45 PM Christopher Ertl wrote:\n> So I'm proposing to remove the check for the drive letter being alpha in `has_dos_drive_prefix` macro:\n>\n> #define has_dos_drive_prefix(path) \\\n> ( (path)[1] == ':' ? 2 : 0)\n\nNit: This isn't safe and will access memory beyond end-of-string if path is zero-length. Perhaps something like this would be better:\n\n #define has_dos_drive_prefix(path) \\\n (*(path) && (path)[1] == ':' ? 2 : 0)\n"},{"id":"380186","messageId":"20190809002246.GL118825@genre.crustytoothpaste.net","threadId":"51609","inReplyTo":"DB7PR83MB0268816EF2F435EF791272C197D70@DB7PR83MB0268.EURPRD83.prod.outlook.com","subject":"Re: Windows absolute drive path detection incomplete","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2019-08-09T00:22:46Z","receivedAt":"2019-08-09T00:22:56Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2019-08-08 at 16:44:52, Christopher Ertl wrote:\n> So I'm proposing to remove the check for the drive letter being alpha in `has_dos_drive_prefix` macro:\n> \n> #define has_dos_drive_prefix(path) \\\n> \t( (path)[1] == ':' ? 2 : 0)\n\nIs the drive character required to be ASCII? If it can be non-ASCII\nUnicode, then this doesn't work, because the drive character will be\nencoded in UTF-8 and will be longer than one character.\n\nAn ABNF grammar of valid Windows path names would be helpful here.\n-- \nbrian m. carlson: Houston, Texas, US\nOpenPGP: https://keybase.io/bk2204\n"}]}