tyler.durden/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2025-07-29 08:44:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Stop execution if unexpected characters were found. Also move hyphen to end to list, otherwise it may not work as a matchin character

Browse Source
This commit is contained in:
Michael Boelen 2019-08-20 14:17:05 +02:00
parent f51f19f621
commit e7d6aaa44d
No known key found for this signature in database
GPG Key ID: 26141F77A09D7F04
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
include/profiles
View File

@ -45,16 +45,17 @@
sleep 30 sleep 30
fi fi
# Security check for unexpected and possibly harmful escape characters # Security check for unexpected and possibly harmful escape characters (hyphen should be listed as first or last character)
DATA=$(grep -v '^$\|^ \|^#\|^config:' ${PROFILE} | tr -d '[:alnum:]/\[\]\(\)\-_\|,\.:;= \n\r' | od -An -ta | sed 's/ /!space!/g') DATA=$(grep -v '^$\|^ \|^#\|^config:' ${PROFILE} | tr -d '[:alnum:]/\[\]\(\)_\|,\.:;= \n\r-' | od -An -ta | sed 's/ /!space!/g')
if ! IsEmpty "${DATA}"; then if ! IsEmpty "${DATA}"; then
DisplayWarning "Your profile '${PROFILE}' contains unexpected characters. See the log file for more information." DisplayWarning "Your profile '${PROFILE}' contains unexpected characters. See the log file for more information."
LogText "Found unexpected or possibly harmful characters in the profile. See output below." LogText "Found unexpected or possibly harmful characters in profile '${PROFILE}'. See which characters matched in the output below and compare them with your profile."
for I in "${DATA}"; do for I in "${DATA}"; do
I=$(echo ${I} | sed 's/!space!/ /g') I=$(echo ${I} | sed 's/!space!/ /g')
LogText "Output: ${I}" LogText "Output: ${I}"
done done
sleep 30 LogText "Suggestion: comment incorrect lines with a '#' and try again. Open a GitHub issue if valid characters are blocked"
ExitFatal "unexpected characters in profile. Stopping execution (security measure)"
fi fi
# Now parse the profile and filter out unwanted characters # Now parse the profile and filter out unwanted characters