From 049323e7e03c64f534a73ff452d218f19d5b8132 Mon Sep 17 00:00:00 2001 From: D Brashear Date: Fri, 18 Jul 2014 16:00:12 -0400 Subject: [PATCH] vlserver: limit use of regex to admins always allow regexes only if the querying user is a superuser. if the superuser uses up all the resources, well, they could just do whatever damage directly anyway. means even in unrestricted mode we are not vulnerable Change-Id: Ib35d649f31e752ba5ae8373a06b67ea76f97425c Reviewed-on: http://gerrit.openafs.org/11968 Reviewed-by: Daria Brashear Reviewed-by: Mark Vitale Tested-by: BuildBot Reviewed-by: Benjamin Kaduk --- src/vlserver/vlprocs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/vlserver/vlprocs.c b/src/vlserver/vlprocs.c index f69ba58..6a72c94 100644 --- a/src/vlserver/vlprocs.c +++ b/src/vlserver/vlprocs.c @@ -1729,6 +1729,10 @@ ListAttributesN2(struct rx_call *rxcall, findpartition = ((attributes->Mask & VLLIST_PARTITION) ? 1 : 0); findflag = ((attributes->Mask & VLLIST_FLAG) ? 1 : 0); if (name && (strcmp(name, ".*") != 0) && (strcmp(name, "") != 0)) { + if (!afsconf_SuperUser(vldb_confdir, rxcall, NULL)) { + code = VL_PERM; + goto done; + } sprintf(volumename, "^%s$", name); #ifdef HAVE_POSIX_REGEX if (regcomp(&re, volumename, REG_NOSUB) != 0) { -- 1.9.4