From e14d8beedfa0cc7758451d4247b54d4d032e22c5 Mon Sep 17 00:00:00 2001 From: "https://id.koumbit.net/anarcat" Date: Tue, 31 May 2016 10:41:15 -0400 Subject: [PATCH] small security review and suggestions --- doc/plugins/contrib/compile.mdwn | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/doc/plugins/contrib/compile.mdwn b/doc/plugins/contrib/compile.mdwn index 7527f2698..7a3f58539 100644 --- a/doc/plugins/contrib/compile.mdwn +++ b/doc/plugins/contrib/compile.mdwn @@ -21,7 +21,9 @@ Some important security notice. - This plugins allows user to execute arbitrary commands when compiling the wiki. Use at your own risk. If you use Ikiwiki as a static web site compiler (and not a wiki), and you are the only one to compile the wiki, there is no - risk. + risk. If you *do* allow untrusted users to edit or comment on the wiki, they + can use the `compile` directives to execute completely arbitrary code, regardless + of configuration safeguards you may put. - Source files are published, wheter option `source` is true or not. If `source` is false, source may not be *advertised*, but it is still available @@ -30,6 +32,18 @@ Some important security notice. do not use this plugin if you do not want to publish your source files (sorry: I designed this plugin to publish free stuff). +The plugin could be modified to only allow commands to be modified from the +configuration and it would be safer to use. However, it would still be vulnerable +to command injection attacks because it uses `qx()` command expansion, which +runs commands through `/bin/sh -c`. A thorough security review would be in order +before this should be considered secure running on untrusted input. + +A simpler implementation, that only runs a predefined set of commands, may be +simpler to implement than auditing this whole plugin. For example, the +[[bibtex2html]] module performs a similar task than the compile module, but +hardcodes the command used and doesn't call it with `/bin/sh -c`. It could be +expanded to cover more commands. + ## Rationale I want to publish some latex files, both source (`.tex`) and compiled (`.pdf`) -- 2.39.2