Repository navigation
fix(security): fix sandbox bypass and panic when -sandbox and -python are both set - #222
Draft
neo-by-projectdiscovery[bot] wants to merge 1 commit into
Draft
neo-by-projectdiscovery[bot] wants to merge 1 commit into
neo-by-projectdiscovery[bot] wants to merge 1 commit into
Conversation
… are both set
PythonStyle previously accepted http.Dir via a type assertion:
httpHandler = PythonStyle(dir.(http.Dir))
When -sandbox is also set, dir is a SandboxFileSystem, not http.Dir.
The assertion panics at startup:
interface conversion: http.FileSystem is httpserver.SandboxFileSystem, not http.Dir
Beyond the crash, Python mode also bypassed SandboxFileSystem's
containment checks (dot-file filter, symlink rejection, single-level
glob) even when -sandbox was not set, because it built raw OS paths
via filepath.Join+os.Stat instead of using the FileSystem's Open().
Fix:
- Change PythonStyle to accept http.FileSystem (not http.Dir)
- Replace os.Stat + raw filepath.Join path construction with fs.Open()
so SandboxFileSystem's Open() is always consulted
- Delegate actual file/directory serving to http.FileServer(root)
which also uses the FileSystem
Regression tests: TestPythonStyleAcceptFileSystem,
TestNewServerSandboxPythonNoPanic
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two related security issues in Python listing mode.
1. Runtime panic (DoS) — Sandbox + Python mode
File:
pkg/httpserver/httpserver.go:65When
-sandboxis set,diris aSandboxFileSystem, nothttp.Dir. The type assertion panics at server startup:interface conversion: http.FileSystem is httpserver.SandboxFileSystem, not http.Dir2. Sandbox bypass in Python listing mode
File:
pkg/httpserver/pythonliststyle.goPython mode constructed raw filesystem paths via
os.Stat/http.ServeFiledirectly, completely bypassingSandboxFileSystem's dot-file filter, symlink rejection, and containment checks.Fix
PythonStyleto accepthttp.FileSystem(nothttp.Dir)fs.Open()soSandboxFileSystem.Open()is always exercisedhttp.FileServer(root)Tests added (both fail without fix)
TestPythonStyleAcceptFileSystemTestNewServerSandboxPythonNoPanic