已开启
fix CreateSoftlink #2260
dongtingchi创建于 25 天前
fix CreateSoftlink #2260
已开启
共 3 个文件变更+55-3
| @@ -64,6 +64,7 @@ private: | |||
| 64 | TarFileInfo &tarFileInfo); | 64 | TarFileInfo &tarFileInfo); |
| 65 | bool FileReadAndWrite(char *destBuff, FILE *destF, size_t readBuffSize); | 65 | bool FileReadAndWrite(char *destBuff, FILE *destF, size_t readBuffSize); |
| 66 | void HandleRegularEUnpackFile(char *buff, ParseTarPath *parseTarPath, bool &isSkip, TarFileInfo &tarFileInfo); | 66 | void HandleRegularEUnpackFile(char *buff, ParseTarPath *parseTarPath, bool &isSkip, TarFileInfo &tarFileInfo); |
| 67 | + void HandleSymType(ParseTarPath *parseTarPath, bool &isSkip, bool &isSoftLink, TarFileInfo &tarFileInfo); | ||
| 67 | bool ProcessTarBlock(char *buff, EParseType type, ParseTarPath *parseTarPath, bool &isSkip, bool &isSoftLink); | 68 | bool ProcessTarBlock(char *buff, EParseType type, ParseTarPath *parseTarPath, bool &isSkip, bool &isSoftLink); |
| 68 | bool IsValidTarBlock(const TarHeader *tarHeader); | 69 | bool IsValidTarBlock(const TarHeader *tarHeader); |
| 69 | bool VerifyChecksum(const TarHeader *tarHeader); | 70 | bool VerifyChecksum(const TarHeader *tarHeader); |
| @@ -25,6 +25,7 @@ | |||
| 25 | 25 | ||
| 26 | 26 | ||
| 27 | 27 | ||
| 28 | + | ||
| 28 | 29 | ||
| 29 | namespace installd { | 30 | namespace installd { |
| 30 | const uid_t OCTAL = 8; | 31 | const uid_t OCTAL = 8; |
| @@ -335,6 +336,21 @@ int UnTarFile::CheckFileAndInitPath(const char *rootPath, ParseTarPath *parseTar | |||
| 335 | return 0; | 336 | return 0; |
| 336 | } | 337 | } |
| 337 | 338 | ||
| 339 | +void UnTarFile::HandleSymType(ParseTarPath *parseTarPath, bool &isSkip, bool &isSoftLink, TarFileInfo &tarFileInfo) | ||
| 340 | +{ | ||
| 341 | + if (parseTarPath->fullPath != nullptr && parseTarPath->realLink != nullptr && | ||
| 342 | + OHOS::FileManagement::Backup::BDir::IsFilePathValid(std::string(parseTarPath->fullPath)) && | ||
| 343 | + OHOS::FileManagement::Backup::BDir::IsFilePathValid(std::string(parseTarPath->realLink))) { | ||
| 344 | + CreateSoftlink(parseTarPath->realLink, parseTarPath->fullPath); | ||
| 345 | + isSoftLink = true; | ||
| 346 | + isSkip = false; | ||
| 347 | + } else { | ||
| 348 | + LOGE("SYMTYPE path validation failed, symlink creation forbidden"); | ||
| 349 | + isSkip = true; | ||
| 350 | + fseeko(FilePtr, tarFileInfo.fileBlockCnt * BLOCK_SIZE, SEEK_CUR); | ||
| 351 | + } | ||
| 352 | +} | ||
| 353 | + | ||
| 338 | bool UnTarFile::ProcessTarBlock(char *buff, EParseType type, ParseTarPath *parseTarPath, bool &isSkip, bool &isSoftLink) | 354 | bool UnTarFile::ProcessTarBlock(char *buff, EParseType type, ParseTarPath *parseTarPath, bool &isSkip, bool &isSoftLink) |
| 339 | { | 355 | { |
| 340 | TarHeader *tarHeader = (TarHeader *)buff; | 356 | TarHeader *tarHeader = (TarHeader *)buff; |
| @@ -355,9 +371,7 @@ bool UnTarFile::ProcessTarBlock(char *buff, EParseType type, ParseTarPath *parse | |||
| 355 | HandleRegularFile(buff, type, parseTarPath, isSkip, tarFileInfo); | 371 | HandleRegularFile(buff, type, parseTarPath, isSkip, tarFileInfo); |
| 356 | break; | 372 | break; |
| 357 | case SYMTYPE: | 373 | case SYMTYPE: |
| 358 | - CreateSoftlink(parseTarPath->realLink, parseTarPath->fullPath); | 374 | + HandleSymType(parseTarPath, isSkip, isSoftLink, tarFileInfo); |
| 359 | - isSoftLink = true; | ||
| 360 | - isSkip = false; | ||
| 361 | break; | 375 | break; |
| 362 | case DIRTYPE: | 376 | case DIRTYPE: |
| 363 | CreateDir(parseTarPath->fullPath, FILE_MODE); | 377 | CreateDir(parseTarPath->fullPath, FILE_MODE); |
| @@ -366,4 +366,41 @@ HWTEST_F(InstalldUnTarFileTest, Installd_Un_Tar_File_ProcessTarBlock_0100, testi | |||
| 366 | } | 366 | } |
| 367 | GTEST_LOG_(INFO) << "InstalldUnTarFileTest-end Installd_Un_Tar_File_ProcessTarBlock_0100"; | 367 | GTEST_LOG_(INFO) << "InstalldUnTarFileTest-end Installd_Un_Tar_File_ProcessTarBlock_0100"; |
| 368 | } | 368 | } |
| 369 | + | ||
| 370 | +/** | ||
| 371 | + * @tc.number: Installd_Un_Tar_File_HandleSymType_0100 | ||
| 372 | + * @tc.name: Installd_Un_Tar_File_HandleSymType_0100 | ||
| 373 | + * @tc.desc: test HandleSymType rejects symlink with path traversal | ||
| 374 | + * @tc.size: MEDIUM | ||
| 375 | + * @tc.type: FUNC | ||
| 376 | + * @tc.level Level 1 | ||
| 377 | + * @tc.require: IC15LE | ||
| 378 | + */ | ||
| 379 | +HWTEST_F(InstalldUnTarFileTest, Installd_Un_Tar_File_HandleSymType_0100, testing::ext::TestSize.Level1) | ||
| 380 | +{ | ||
| 381 | + GTEST_LOG_(INFO) << "InstalldUnTarFileTest-begin Installd_Un_Tar_File_HandleSymType_0100"; | ||
| 382 | + try { | ||
| 383 | + const TestManager tm("Installd_Un_Tar_File_HandleSymType_0100"); | ||
| 384 | + const string rootPath = tm.GetRootDirCurTest(); | ||
| 385 | + UnTarFile unTarFile(rootPath.c_str()); | ||
| 386 | + TarHeader headBuff = {}; | ||
| 387 | + headBuff.size[0] = '0'; | ||
| 388 | + headBuff.typeflag = SYMTYPE; | ||
| 389 | + ParseTarPath parseTarPath = {}; | ||
| 390 | + string fullPath = rootPath + "/../etc/passwd"; | ||
| 391 | + string realLink = "/data/local/tmp/link"; | ||
| 392 | + parseTarPath.fullPath = const_cast<char *>(fullPath.c_str()); | ||
| 393 | + parseTarPath.realLink = const_cast<char *>(realLink.c_str()); | ||
| 394 | + bool isSkip = false; | ||
| 395 | + bool isSoftLink = false; | ||
| 396 | + unTarFile.ProcessTarBlock((char *)(&headBuff), | ||
| 397 | + UnTarFile::EParseType::eUnpack, &parseTarPath, isSkip, isSoftLink); | ||
| 398 | + EXPECT_TRUE(isSkip); | ||
| 399 | + EXPECT_FALSE(isSoftLink); | ||
| 400 | + } catch (...) { | ||
| 401 | + EXPECT_TRUE(false); | ||
| 402 | + GTEST_LOG_(INFO) << "InstalldUnTarFileTest-an exception occurred by HandleSymType."; | ||
| 403 | + } | ||
| 404 | + GTEST_LOG_(INFO) << "InstalldUnTarFileTest-end Installd_Un_Tar_File_HandleSymType_0100"; | ||
| 405 | +} | ||
| 369 | } // namespace OHOS::FileManagement::Backup | 406 | } // namespace OHOS::FileManagement::Backup |