arif/xcat-core
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Disable storable encoding for client

Browse Source 
Clever things can live in Storable payloads that can essentially be remote execution.
Disable that for now.
This commit is contained in:
Jarrod Johnson 2013-10-11 15:57:29 -04:00
parent 5bfcf11689
commit 62b436be08
2 changed files with 18 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
perl-xCAT/xCAT/Client.pm
View File

@ -261,11 +261,14 @@ if (ref($request) eq 'HASH') { # the request is an array, not pure XML
}
my $msg;
my $encode = "storable";
my $straightprint=0;
if ($ENV{XCATXMLTRACE} or $ENV{XCATXMLWARNING}) { $encode="xml"; }
my $encode = "xml";
#storable encoding is unsafe, carry on with the unsafe xml scheme
#perhaps one day will support faster schemes
#my $encode = "storable";
#my $straightprint=0;
#if ($ENV{XCATXMLTRACE} or $ENV{XCATXMLWARNING}) { $encode="xml"; }
if (ref($request) eq 'HASH') { # the request is an array, not pure XML
print $client "xcatencoding: $encode\n";
#print $client "xcatencoding: $encode\n";
my $encok=<$client>;
send_request($request,$client,$encode);
} else { #XML

20
xCAT-server/sbin/xcatd
View File

@ -2055,15 +2055,17 @@ sub service_connection {
while (1) {
unless ($clientsel->can_read(15)) { last; } #don't let an unresponsive client hold us up
my $line = <$sock>; # grab one line, check for mode...
if ($line and $line =~ /^xcatencoding: (.*)/) {
unless ($supported_encodes{$1}) {
print $sock "Unsupported encoding $1\n";
last;
}
print $sock "Encoding accepted\n";
$globalencode=$1;
$line = "";
}
#Commenting out, could be a remote exceution path
#consider sereal one day
#if ($line and $line =~ /^xcatencoding: (.*)/) {
# unless ($supported_encodes{$1}) {
# print $sock "Unsupported encoding $1\n";
# last;
# }
# print $sock "Encoding accepted\n";
# $globalencode=$1;
# $line = "";
#}
$req = get_request($sock,$globalencode,$line);
unless ($req) { last; }
{ #TODO: find closing brace..