anastasis

commit 54fe7eecc663372ed2b42349bc0038b302d587fd
parent ae8b3a6cc3c319ad7130f8727e8d8c4efde017de
Author: Christian Grothoff <christian@grothoff.org>
Date:   Wed, 29 Jul 2026 17:03:12 +0200

post plugin: refuse address fields that look like command-line options

Diffstat:
M
src/authorization/anastasis_authorization_plugin_post.c
 | 
50
++++++++++++++++++++++++++++++++++++++++++++++++++

1 file changed, 50 insertions(+), 0 deletions(-)
diff --git a/src/authorization/anastasis_authorization_plugin_post.c b/src/authorization/anastasis_authorization_plugin_post.c
@@ -192,6 +192,23 @@ get_message (const json_t *messages,
 
 
 /**
+ * Check that @a value cannot be mistaken for a command-line option.  The
+ * address fields are handed to the operator-supplied COMMAND as positional
+ * arguments, and we do not know whether that helper uses an option parser or
+ * honours "--", so we refuse anything option-shaped rather than rely on it.
+ *
+ * @param value field value to check, may be NULL
+ * @return true if @a value is safe to pass as a positional argument
+ */
+static bool
+is_safe_argument (const char *value)
+{
+  return ( (NULL != value) &&
+           ('-' != value[0]) );
+}
+
+
+/**
  * Validate @a data is a well-formed input into the challenge method,
  * i.e. @a data is a well-formed phone number for sending an SMS, or
  * a well-formed e-mail address for sending an e-mail. Not expected to
@@ -268,6 +285,21 @@ post_validate (void *cls,
       return GNUNET_SYSERR;
     return GNUNET_NO;
   }
+  if ( (! is_safe_argument (name)) ||
+       (! is_safe_argument (street)) ||
+       (! is_safe_argument (city)) ||
+       (! is_safe_argument (zip)) ||
+       (! is_safe_argument (country)) )
+  {
+    json_decref (j);
+    if (MHD_NO ==
+        TALER_MHD_reply_with_error (connection,
+                                    MHD_HTTP_CONFLICT,
+                                    TALER_EC_ANASTASIS_POST_INVALID,
+                                    "address fields must not begin with `-'"))
+      return GNUNET_SYSERR;
+    return GNUNET_NO;
+  }
   json_decref (j);
   return GNUNET_OK;
 }
@@ -419,6 +451,24 @@ post_challenge (struct ANASTASIS_AUTHORIZATION_State *as,
       return ANASTASIS_AUTHORIZATION_CRES_FAILED_REPLY_FAILED;
     return ANASTASIS_AUTHORIZATION_CRES_FAILED;
   }
+  /* Re-checked here and not only in #post_validate(), because truths stored
+     before that check existed would otherwise still reach the helper. */
+  if ( (! is_safe_argument (name)) ||
+       (! is_safe_argument (street)) ||
+       (! is_safe_argument (city)) ||
+       (! is_safe_argument (zip)) ||
+       (! is_safe_argument (country)) )
+  {
+    GNUNET_break_op (0);
+    mres = TALER_MHD_reply_with_error (connection,
+                                       MHD_HTTP_INTERNAL_SERVER_ERROR,
+                                       TALER_EC_ANASTASIS_POST_INVALID,
+                                       "address fields must not begin with `-'")
+    ;
+    if (MHD_YES != mres)
+      return ANASTASIS_AUTHORIZATION_CRES_FAILED_REPLY_FAILED;
+    return ANASTASIS_AUTHORIZATION_CRES_FAILED;
+  }
   if (NULL == as->msg)
   {
     /* First time, start child process and feed pipe */