Repository navigation
More security robustifications - #2781
Merged
Merged
Conversation
A flowr.json found in the analyzed project could set the R executable. Security-sensitive options are now dropped from such a config unless --trust-config is given. Reported by Artur Chlebicki (@Artur12555).
Namespace references in .rda/.rds/.rdx files were resolved by pasting the names read from the file, unescaped, into R code run in a fresh R session. A crafted file of an analyzed project could thus run arbitrary R code (even with the tree-sitter engine, as long as R is on the PATH). flowR now reads such references as an unknown environment, without R.
Clients of the server could use every REPL command, including the master scripts (e.g., ':slicer -o <path>' writes anywhere and '--config-json' can choose the R executable) and ':signature add/download'. Such commands are now marked localOnly and refused for server clients; a test demands that every command is classified. Config queries can no longer change security-sensitive options either.
Release tags, file names, and content hashes from a (remote or project- supplied) signature database were joined into cache paths unchecked, so '../' could write outside the cache. They now pass joinUntrustedSegment, which refuses everything that could leave the directory. The remote pointer is no longer read from the working directory, which may be the analyzed project.
Any web page could connect to a local websocket server (cross-site
WebSocket hijacking). The server now accepts clients without an Origin
(no browser), pages from localhost, and origins given with the new
--ws-allow-origin option ('*' allows all).
With --secure (or FLOWR_SECURE_MODE=1), flowR never starts R or any other process, never accesses the network or the clipboard, does not search for a project config, ignores security-sensitive and regex options in every config and in linter rule configs, and bounds how far project files may decompress. The checks sit where the operations happen (process spawn, network request, ...), so they also cover code paths added later. Once enabled, the secure mode cannot be disabled.
Member
Author
|
This pull request is included in v2.16.1 (see Release v2.16.1 (Security Hardening and Performance Improvements)). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.