projects / project / luci.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 35df2ad) | patch
luci-base: sys: prevent path traversal via sys.init routines
authorJo-Philipp Wich <jo@mein.io>
Wed, 19 Jan 2022 15:32:52 +0000 (16:32 +0100)
committerJo-Philipp Wich <jo@mein.io>
Wed, 19 Jan 2022 15:32:52 +0000 (16:32 +0100)
commit8752701b0d01a81d0bd0a735be733f24ad11ab69
tree48741b61bb0a70dc78bdc815df7a67f1f14aeea1tree | snapshot
parent35df2adaf8a2c5b4fa61f58049f409ca087c0547commit | diff
luci-base: sys: prevent path traversal via sys.init routines

Filter the init script name parameter through fs.basename() to avoid
invoking paths outside of /etc/init.d/.

Reported-by: Graham R <gr348@cam.ac.uk>
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
modules/luci-base/luasrc/sys.lua diff | blob | history
Lua Configuration Interface (mirror)