1806899 - Sanitize tarfile.extractall input

Status: RESOLVED FIXED

(Release Engineering :: General, defect)

Description

[Geoff Brown [:gbrown]]

See https://github.com/mozilla-releng/scriptworker-scripts/pull/593 and https://github.com/advisories/GHSA-gw9q-c7gh-j9vm

Comment 1

[Geoff Brown [:gbrown]]

Attachment: Bug 1806899 - Sanitize extractall input (mozharness)

Comment 2

[Geoff Brown [:gbrown]]

Attachment: Bug 1806899 - Sanitize extractall input (mozbuild)

Comment 3

[Julien Cristau [:jcristau]]

Attachment: Bug 1806899 - test unpacking crafted archives

• archive-escape.tar is the same as archive.tar with an extra empty
  ../../../../../../../etc/passwd member appended
• archive-setuid.tar is the same as archive.tar with an extra empty
  ./bin/setuid member appended, with mode 1744

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b171320171a1
Sanitize extractall input (mozharness) r=jcristau

Comment 5

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/b171320171a1

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7b37ded95024
test unpacking crafted archives r=gbrown

Comment 7

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/7b37ded95024

Comment 8

[BMO Automation]

Attachment: [mozilla-releng/tooltool] Bug 1806899 - Sanitize extractall input, and bump version (#1066)

Comment 9

[Geoff Brown [:gbrown]]

Attachment: Bug 1806899 - Sanitize extractall input (m-c tooltool)

Syncs m-c copy of tooltool.py with https://github.com/mozilla-releng/tooltool/pull/1066

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6e5ab36bae64
Sanitize extractall input (m-c tooltool) r=jcristau

Comment 11

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/6e5ab36bae64

Comment 12

[Geoff Brown [:gbrown]]

Attachment: Bug 1806899 - Harden mozfile extract_tarball

Add a check for setuid/gid on each tar member to be extracted.
Modify the check for escaping the destination: This should catch
absolute paths now, and also allow for the unusual but innocuous
case of "<subdir>/..".

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2fbbe5e4b32f
Harden mozfile extract_tarball r=ahal

Comment 14

[Geoff Brown [:gbrown]]

Attachment: Bug 1806899 - Sanitize extractall input (remaining)

Comment 16

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/2fbbe5e4b32f

Comment 17

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3eab2cd717ad
Sanitize extractall input (remaining) r=jcristau

Comment 18

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/30c4cf95cc4d
Sanitize extractall input (mozbuild) r=jcristau

Comment 19

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/3eab2cd717ad
https://hg.mozilla.org/mozilla-central/rev/30c4cf95cc4d

Comment 20

[BMO Automation]

Attachment: [mozilla-releng/tooltool] Bug 1806899 - Detect link escapes in safe_extract (#1077)

Comment 21

[BMO Automation]

Attachment: [mozilla-releng/tooltool] Bug 1806899 - Detect link escapes in safe_extract (#1084)

Comment 22

[Geoff Brown [:gbrown]]

Attachment: Bug 1806899 - Detect link escapes in safe_extract (all m-c)

Apply the link escape check from tooltool to all the m-c tarfile extractions
previously updated.

Comment 23

[BMO Automation]

Attachment: [mozilla-releng/scriptworker-scripts] Bug 1806899 - [flatpakscript] Detect link escapes in safe_extract (#674)

Comment 24

[BMO Automation]

Attachment: [mozilla-releng/tooltool] Bug 1806899 - Remove unused members parameter from safe_extract (#1088)

Comment 25

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/79967b676cf8
Detect link escapes in safe_extract (all m-c) r=jcristau

Comment 26

[Geoff Brown [:gbrown]]

Attachment: Bug 1806899 - Update vendored copy of tooltool client (wpt)

Update the web-platform tests' copy of tooltool client with the latest version from the tooltool repo.

Comment 27

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/79967b676cf8

Comment 28

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/907dd0b20c7f
Update vendored copy of tooltool client (wpt) r=jgraham

Comment 29

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/38786 for changes under testing/web-platform/tests

Comment 30

[Geoff Brown [:gbrown]]

I found another copy of tooltool.py in mozilla-vpn-client: https://github.com/mozilla-mobile/mozilla-vpn-client/pull/6208

Comment 31

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/907dd0b20c7f

Comment 32

[BMO Automation]

Attachment: [mozilla-releng/scriptworker-scripts] Bug 1806899 - [signingscript] update vendored mozbuild (#682)

Comment 33

[BMO Automation]

Attachment: [mozilla-releng/scriptworker-scripts] Bug 1806899 - Update vendored mozbuild (top level) (#683)

Comment 34

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Upstream PR merged by jgraham

Comment 35

[BMO Automation]

Attachment: [mozilla-releng/scriptworker-scripts] Bug 1806899 - [signingscript] use safe_extract for one more tar extraction (#688)