375740 - ensure files that a mar updates are relative (not absolute) and are safe

Status: RESOLVED FIXED

(Toolkit :: Application Update, defect)

Description

[(not reading, please use [e-mail] instead)]

ensure files that a mar updates are relative (not absolute) and are safe.

pointed out today at window's talk, so there might be a bug on this already (but I haven't seen it.)

thanks to window and her team for pointing this out.

see http://lxr.mozilla.org/seamonkey/source/toolkit/mozapps/update/src/updater/updater.cpp

for example, we should fix:

653 int
654 AddFile::Parse(char *line)
655 {
656   // format "<newfile>"
657 
658   mFile = mstrtok(kQuote, &line);
659   if (!mFile)
660     return PARSE_ERROR;
661 
662   return OK;
663 }

so that if mFile is absolute (or contains unsafe characters) we should report an error and not apply the mar.

Comment 1

[Benjamin Smedberg]

Not that we shouldn't fix this, but why is it security sensitive? If you have a bad MAR, there are lots of ways to exploit it (bsdiff is probably very easy to exploit). We inherently trust the contents of a MAR, which is why we verify the signature carefully before staging.

Comment 2

[(not reading, please use [e-mail] instead)]

> Not that we shouldn't fix this, but why is it security sensitive?

I was erring on the side of caution.

Comment 3

[Robert Strong (they/them - no direct email)]

Fixing this in bug 386760. I mainly want this for when we have a service performing updates.

Comment 4

[Robert Strong (they/them - no direct email)]

Fixed by bug 386760