diff options
| author | Gunnar Mills <gmills@us.ibm.com> | 2017-10-06 14:47:10 -0500 |
|---|---|---|
| committer | Brad Bishop <bradleyb@fuzziesquirrel.com> | 2017-10-24 13:42:45 +0000 |
| commit | 1902990db9c36a8c2f4a57a4389c1a0c74658584 (patch) | |
| tree | 256c223fa82e16ff540bade4123adce5ec44ebe3 | |
| parent | 1be4fabdcb00d17f3b4dc2b563125e661692948d (diff) | |
| download | talos-skeleton-1902990db9c36a8c2f4a57a4389c1a0c74658584.tar.gz talos-skeleton-1902990db9c36a8c2f4a57a4389c1a0c74658584.zip | |
Add basename for file name in download manager
Added getting the basename for the output file name in
download manager. This is to prevent any security holes
that would let the user out of the FLASH_DOWNLOAD_PATH dir.
(e.g. passing a file name of ../etc/shadow)
Resolves openbmc/openbmc#1898
Change-Id: Ie33fe56599e86c29da4b2eae8ef070f0866d054c
Signed-off-by: Gunnar Mills <gmills@us.ibm.com>
| -rw-r--r-- | pydownloadmgr/download_manager.py | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/pydownloadmgr/download_manager.py b/pydownloadmgr/download_manager.py index 3cc9f28..7ba80ca 100644 --- a/pydownloadmgr/download_manager.py +++ b/pydownloadmgr/download_manager.py @@ -1,5 +1,6 @@ #!/usr/bin/env python +import os import gobject import dbus import dbus.service @@ -40,7 +41,7 @@ class DownloadManagerObject(dbus.service.Object): try: filename = str(filename) print "Downloading: "+filename+" from "+ip - outfile = FLASH_DOWNLOAD_PATH+"/"+filename + outfile = FLASH_DOWNLOAD_PATH+"/"+os.path.basename(filename) rc = subprocess.call( ["tftp", "-l", outfile, "-r", filename, "-g", ip]) if (rc == 0): @@ -58,7 +59,7 @@ class DownloadManagerObject(dbus.service.Object): try: filename = str(filename) print "Downloading: "+filename+" from "+url - outfile = FLASH_DOWNLOAD_PATH+"/"+filename + outfile = FLASH_DOWNLOAD_PATH+"/"+os.path.basename(filename) subprocess.call( ["tftp", "-l", outfile, "-r", filename, "-g", url]) obj = bus.get_object("org.openbmc.control.Flash", path) |
