anastasis

commit daaa90077fa1040d486fdb3554f10c2ea9902533
parent 12a42b8afec72e902bea707f8d5083f08ab2cac3
Author: Christian Grothoff <christian@grothoff.org>
Date:   Tue,  4 Aug 2026 15:22:37 +0200

check e-mail does not start with '-' as that might be mis-interpreted as a command-line option

Diffstat:
M
src/authorization/anastasis_authorization_plugin_email.c
 | 
55
++++++++++++++++++++++++++++++++++++++++++++++++++-----

1 file changed, 50 insertions(+), 5 deletions(-)
diff --git a/src/authorization/anastasis_authorization_plugin_email.c b/src/authorization/anastasis_authorization_plugin_email.c
@@ -207,6 +207,26 @@ get_message (const json_t *messages,
 
 
 /**
+ * Check that @a value can be passed to the helper as a positional argument.
+ * The address is handed to #GNUNET_process_run_command_va(), i.e. it becomes
+ * argv[1] of the (site-supplied) command; an address starting with '-' would
+ * be read as an option by whatever that command is.  The e-mail grammar does
+ * allow a leading '-' in the local part, so this has to be screened out
+ * explicitly.  Not every helper honours "--", so we refuse anything
+ * option-shaped rather than rely on it.
+ *
+ * @param value address to check, may be NULL
+ * @return true if @a value is safe to pass as a positional argument
+ */
+static bool
+is_safe_argument (const char *value)
+{
+  return ( (NULL != value) &&
+           ('-' != value[0]) );
+}
+
+
+/**
  * Validate @a data is a well-formed input into the challenge method,
  * i.e. @a data is a well-formed phone number for sending an SMS, or
  * a well-formed e-mail address for sending an e-mail. Not expected to
@@ -232,16 +252,18 @@ email_validate (void *cls,
 {
   struct Email_Context *ctx = cls;
   int regex_result;
-  char *phone_number;
+  bool safe;
+  char *email;
 
-  phone_number = GNUNET_strndup (data,
-                                 data_length);
+  email = GNUNET_strndup (data,
+                          data_length);
   regex_result = regexec (&ctx->regex,
-                          phone_number,
+                          email,
                           0,
                           NULL,
                           0);
-  GNUNET_free (phone_number);
+  safe = is_safe_argument (email);
+  GNUNET_free (email);
   if (0 != regex_result)
   {
     if (MHD_NO ==
@@ -252,6 +274,16 @@ email_validate (void *cls,
       return GNUNET_SYSERR;
     return GNUNET_NO;
   }
+  if (! safe)
+  {
+    if (MHD_NO ==
+        TALER_MHD_reply_with_error (connection,
+                                    MHD_HTTP_CONFLICT,
+                                    TALER_EC_ANASTASIS_EMAIL_INVALID,
+                                    "address must not begin with `-'"))
+      return GNUNET_SYSERR;
+    return GNUNET_NO;
+  }
   return GNUNET_OK;
 }
 
@@ -351,6 +383,19 @@ email_challenge (struct ANASTASIS_AUTHORIZATION_State *as,
   const char *mime;
   const char *lang;
 
+  /* Re-checked here and not only in #email_validate(), because truths stored
+     before that check existed would otherwise still reach the helper. */
+  if (! is_safe_argument (as->email))
+  {
+    GNUNET_break_op (0);
+    mres = TALER_MHD_reply_with_error (connection,
+                                       MHD_HTTP_INTERNAL_SERVER_ERROR,
+                                       TALER_EC_ANASTASIS_EMAIL_INVALID,
+                                       "address must not begin with `-'");
+    if (MHD_YES != mres)
+      return ANASTASIS_AUTHORIZATION_CRES_FAILED_REPLY_FAILED;
+    return ANASTASIS_AUTHORIZATION_CRES_FAILED;
+  }
   mime = MHD_lookup_connection_value (connection,
                                       MHD_HEADER_KIND,
                                       MHD_HTTP_HEADER_ACCEPT);