From f9a78e3d94abad668821ce9bc4a22edd77e45b14 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Dachary?= Date: Mon, 17 Oct 2022 07:34:40 +0000 Subject: [PATCH] new deploy: 2022-10-17T07:34:40+00:00 --- blog/1-17-3-git-security/index.html | 327 ++++++++++++++++++++++++++++ blog/atom.xml | 25 ++- blog/index.html | 39 ++++ search_index.en.js | 2 +- sitemap.xml | 10 + tags/gitea/atom.xml | 25 ++- tags/gitea/index.html | 30 +++ tags/gna/atom.xml | 25 ++- tags/gna/index.html | 30 +++ tags/index.html | 48 +++- tags/problem/atom.xml | 25 ++- tags/problem/index.html | 30 +++ tags/security/atom.xml | 32 +++ tags/security/index.html | 318 +++++++++++++++++++++++++++ tags/solution/atom.xml | 32 +++ tags/solution/index.html | 318 +++++++++++++++++++++++++++ tags/upgrade/atom.xml | 25 ++- tags/upgrade/index.html | 30 +++ 18 files changed, 1361 insertions(+), 10 deletions(-) create mode 100644 blog/1-17-3-git-security/index.html create mode 100644 tags/security/atom.xml create mode 100644 tags/security/index.html create mode 100644 tags/solution/atom.xml create mode 100644 tags/solution/index.html diff --git a/blog/1-17-3-git-security/index.html b/blog/1-17-3-git-security/index.html new file mode 100644 index 0000000..4c0137d --- /dev/null +++ b/blog/1-17-3-git-security/index.html @@ -0,0 +1,327 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + [security] Gitea < 1.17.3 git option injection explained | Gna!: Managed Gitea Hosting + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + +
+ +
+
+ + +
+

[security] Gitea < 1.17.3 git option injection explained

+

+ + + + Loïc Dachary + + + + + · 17 + October + +, + 2022 · 2 min read +

+ + +
+

Gitea 1.17.3 includes a security patch that prevents the injection of arguments to the git command run by Gitea.

+

When displaying the commit graph for the master branch, the URL contains the argument refs%2Fheads%2Fmaster that is passed to the git command with something like:

+
git log --graph refs/head/master
+
+

If, by accident or maliciously, the branch name with a dash, it would be mistaken to be a git argument instead of a branch name. For instance -h could be passed to the git command as:

+
git log --graph -h
+
+

In reality the rev-list command is called before log and in Gitea 1.17.2 the debug output will show something like:

+
2022/10/17 07:17:17 ...s/web/repo/commit.go:124:Graph() [W] [634d017d] GetCommitGraphsCount error for generate graph exclude prs: false branches: [-h] in 1:root/test, Will Ignore branches and try again. Underlying Error: exit status 129 - usage: git rev-list [<options>] <commit-id>... [-- <path>...]
+...
+
+

In Gitea 1.17.3 when the same command is run, the option is discarded and the debug output shows something like:

+
2022/10/17 07:25:05 ...dules/git/command.go:166:Run() [E] [634d0351] git command is broken: /usr/bin/git -c protocol.version=2 -c uploadpack.allowfilter=true -c uploadpack.allowAnySHA1InWant=true -c credential.helper= rev-list --count, broken args: -h
+2022/10/17 07:25:05 ...s/web/repo/commit.go:124:Graph() [W] [634d0351] GetCommitGraphsCount error for generate graph exclude prs: false branches: [-h] in 1:root/test, Will Ignore branches and try again. Underlying Error: git command is broken
+
+ +
+
+
+
+ + #gna + + #gitea + + #security + + #problem + + #upgrade + + #solution + +
+ +
+ + +
+ + +
+ + diff --git a/blog/atom.xml b/blog/atom.xml index 3c0aecb..03446c1 100644 --- a/blog/atom.xml +++ b/blog/atom.xml @@ -4,8 +4,31 @@ Zola - 2022-07-20T00:00:00+00:00 + 2022-10-17T00:00:00+00:00 https://gna.org/blog/atom.xml + + [security] Gitea < 1.17.3 git option injection explained + 2022-10-17T00:00:00+00:00 + 2022-10-17T00:00:00+00:00 + + https://gna.org/blog/1-17-3-git-security/ + <p><a href="https://pouet.chapril.org/@gna/109176306611564720">Gitea 1.17.3</a> includes a <a href="https://lab.forgefriends.org/forgefriends/forgefriends/-/commit/d98c5db58fdeded983bf5c0fe781fd7b77a1235f">security patch</a> that prevents the injection of arguments to the git command run by Gitea.</p> +<p>When displaying the commit graph <a href="https://gitea.gna.org/Gna/organization/graph?branch=refs%2Fheads%2Fmaster">for the master branch</a>, the URL contains the argument <strong>refs%2Fheads%2Fmaster</strong> that is passed to the <code>git</code> command with something like:</p> +<pre data-lang="shell" style="background-color:#2b303b;color:#c0c5ce;" class="language-shell "><code class="language-shell" data-lang="shell"><span>git log --graph refs/head/master +</span></code></pre> +<p>If, by accident or maliciously, the branch name with a dash, it would be mistaken to be a <code>git</code> argument instead of a branch name. For instance <strong>-h</strong> could be passed to the <code>git</code> command as:</p> +<pre data-lang="shell" style="background-color:#2b303b;color:#c0c5ce;" class="language-shell "><code class="language-shell" data-lang="shell"><span>git log --graph -h +</span></code></pre> +<p>In reality the <code>rev-list</code> command is called before <code>log</code> and in Gitea 1.17.2 the debug output will show something like:</p> +<pre style="background-color:#2b303b;color:#c0c5ce;"><code><span>2022/10/17 07:17:17 ...s/web/repo/commit.go:124:Graph() [W] [634d017d] GetCommitGraphsCount error for generate graph exclude prs: false branches: [-h] in 1:root/test, Will Ignore branches and try again. Underlying Error: exit status 129 - usage: git rev-list [&lt;options&gt;] &lt;commit-id&gt;... [-- &lt;path&gt;...] +</span><span>... +</span></code></pre> +<p>In Gitea 1.17.3 when the same command is run, the option is discarded and the debug output shows something like:</p> +<pre style="background-color:#2b303b;color:#c0c5ce;"><code><span>2022/10/17 07:25:05 ...dules/git/command.go:166:Run() [E] [634d0351] git command is broken: /usr/bin/git -c protocol.version=2 -c uploadpack.allowfilter=true -c uploadpack.allowAnySHA1InWant=true -c credential.helper= rev-list --count, broken args: -h +</span><span>2022/10/17 07:25:05 ...s/web/repo/commit.go:124:Graph() [W] [634d0351] GetCommitGraphsCount error for generate graph exclude prs: false branches: [-h] in 1:root/test, Will Ignore branches and try again. Underlying Error: git command is broken +</span></code></pre> + + 1.17 breaking changes episode 2: preserving a custom gitconfig 2022-07-20T00:00:00+00:00 diff --git a/blog/index.html b/blog/index.html index 22cd77e..fee21c4 100644 --- a/blog/index.html +++ b/blog/index.html @@ -213,6 +213,45 @@