anastasis

commit b90f20cf8d4d343dd2f7bfec9977a881356a696f
parent e0c69918909841ff93c372b810012eb804b2830e
Author: Christian Grothoff <christian@grothoff.org>
Date:   Wed, 29 Jul 2026 13:08:34 +0200

reducer: validate country_code before building the redux file path

Diffstat:
M
src/reducer/anastasis_api_redux.c
 | 
16
++++++++++++++++

1 file changed, 16 insertions(+), 0 deletions(-)
diff --git a/src/reducer/anastasis_api_redux.c b/src/reducer/anastasis_api_redux.c
@@ -949,6 +949,22 @@ redux_id_attr_init (const char *country_code)
   char *dn;
   json_error_t error;
 
+  /* `country_code` originates from untrusted state; it is interpolated into a
+     file path below, so reject anything that is not exactly two ASCII letters
+     to prevent path traversal (e.g. "../../..") into arbitrary JSON files. */
+  {
+    char c0 = country_code[0];
+    char c1 = (c0 == '\0') ? '\0' : country_code[1];
+
+    if ( (2 != strlen (country_code)) ||
+         (! ( ((c0 >= 'A') && (c0 <= 'Z')) || ((c0 >= 'a') && (c0 <= 'z')) )) ||
+         (! ( ((c1 >= 'A') && (c1 <= 'Z')) || ((c1 >= 'a') && (c1 <= 'z')) )) )
+    {
+      GNUNET_break (0);
+      return NULL;
+    }
+  }
+
   if (0 == strcmp (country_code,
                    redux_id_cc))
     return redux_id_attr;