1
0
mirror of https://github.com/CISOfy/lynis.git synced 2025-04-08 17:15:25 +02:00

Stop execution if unexpected characters were found. Also move hyphen to end to list, otherwise it may not work as a matchin character

This commit is contained in:
Michael Boelen 2019-08-20 14:17:05 +02:00
parent f51f19f621
commit e7d6aaa44d
No known key found for this signature in database
GPG Key ID: 26141F77A09D7F04

@ -45,16 +45,17 @@
sleep 30
fi
# Security check for unexpected and possibly harmful escape characters
DATA=$(grep -v '^$\|^ \|^#\|^config:' ${PROFILE} | tr -d '[:alnum:]/\[\]\(\)\-_\|,\.:;= \n\r' | od -An -ta | sed 's/ /!space!/g')
# Security check for unexpected and possibly harmful escape characters (hyphen should be listed as first or last character)
DATA=$(grep -v '^$\|^ \|^#\|^config:' ${PROFILE} | tr -d '[:alnum:]/\[\]\(\)_\|,\.:;= \n\r-' | od -An -ta | sed 's/ /!space!/g')
if ! IsEmpty "${DATA}"; then
DisplayWarning "Your profile '${PROFILE}' contains unexpected characters. See the log file for more information."
LogText "Found unexpected or possibly harmful characters in the profile. See output below."
LogText "Found unexpected or possibly harmful characters in profile '${PROFILE}'. See which characters matched in the output below and compare them with your profile."
for I in "${DATA}"; do
I=$(echo ${I} | sed 's/!space!/ /g')
LogText "Output: ${I}"
done
sleep 30
LogText "Suggestion: comment incorrect lines with a '#' and try again. Open a GitHub issue if valid characters are blocked"
ExitFatal "unexpected characters in profile. Stopping execution (security measure)"
fi
# Now parse the profile and filter out unwanted characters