security
/
fortify
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 14 Wiki Activity

app: validate username
test / test (push) Successful in 23s Details 

This value is used for passwd generation. Bad input can cause very confusing issues. This is not a security issue, however validation will improve user experience.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
This commit is contained in:
Ophestra Umiker 2024-11-19 21:01:41 +09:00
parent d99c8b1fb4
commit 9faf3b3596
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
internal/app/seal.go
View File

@ -5,6 +5,7 @@ import (
"fmt" "fmt"
"io/fs" "io/fs"
"path" "path"
"regexp"
"strconv" "strconv"
shim "git.ophivana.moe/security/fortify/cmd/fshim/ipc" shim "git.ophivana.moe/security/fortify/cmd/fshim/ipc"
@ -19,8 +20,11 @@ var (
ErrConfig = errors.New("no configuration to seal") ErrConfig = errors.New("no configuration to seal")
ErrUser = errors.New("invalid aid") ErrUser = errors.New("invalid aid")
ErrHome = errors.New("invalid home directory") ErrHome = errors.New("invalid home directory")
ErrName = errors.New("invalid username")
) )
var posixUsername = regexp.MustCompilePOSIX("^[a-z_]([A-Za-z0-9_-]{0,31}|[A-Za-z0-9_-]{0,30}\\$)$")
// appSeal seals the application with child-related information // appSeal seals the application with child-related information
type appSeal struct { type appSeal struct {
// app unique ID string representation // app unique ID string representation
@ -106,6 +110,9 @@ func (a *app) Seal(config *Config) error {
} }
if seal.sys.user.username == "" { if seal.sys.user.username == "" {
seal.sys.user.username = "chronos" seal.sys.user.username = "chronos"
} else if !posixUsername.MatchString(seal.sys.user.username) {
return fmsg.WrapError(ErrName,
fmt.Sprintf("invalid user name %q", seal.sys.user.username))
} }
if seal.sys.user.data == "" || !path.IsAbs(seal.sys.user.data) { if seal.sys.user.data == "" || !path.IsAbs(seal.sys.user.data) {
return fmsg.WrapError(ErrHome, return fmsg.WrapError(ErrHome,