EchoPingHttp probe should probably escape shell metachars in url
miiichael opened this issue · 7 comments
While switching a probe from curl to echopinghttp I noticed that I needed to escape semicolons in echoping's url parameter (but not curl's). At the very least, this is inconsistent behaviour, and at worst results in unintended arbitrary code execution when using echoping-based probes.
Debian smokeping 2.7.3-2.
This issue has become stale and will be closed automatically within 7 days. Comment on the issue to keep it alive.
Here, have a comment.
Pre-emptive bump. *glares at stalebot*
hi @miiichael , can you elaborate more on this? I'd like to know if the code execution is reproducible and I think it would help to resolve this issue.
I think the summary is: EchoPingHttp's url value is passed naked to a shell. I feel that the value should instead be protected from interference by it.
Consider these two config fragments:
++ github-curl
menu = github (curl)
probe = Curl
host = github.com
urlformat = https://%host%/?foo=bar;touch /tmp/foo;
++ github-echopinghttp
menu = github (echopinghttp)
probe = EchoPingHttp
host = github.com
url = /?foo=bar;touch /tmp/foo;
At first glance you'd consider them to be equivalent, except they're not. :P
This issue has become stale and will be closed automatically within 7 days. Comment on the issue to keep it alive.
Sigh.