aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorhttps://id.koumbit.net/anarcat <https://id.koumbit.net/anarcat@web>2016-05-31 10:41:15 -0400
committeradmin <admin@branchable.com>2016-05-31 10:41:15 -0400
commite14d8beedfa0cc7758451d4247b54d4d032e22c5 (patch)
treec2dcafbf7c7966c758bbe1161f7bf774023bf093
parenta8ca9591a65eebb53db53cc8998b6cf164ab2899 (diff)
downloadikiwiki-e14d8beedfa0cc7758451d4247b54d4d032e22c5.tar
ikiwiki-e14d8beedfa0cc7758451d4247b54d4d032e22c5.tar.gz
small security review and suggestions
-rw-r--r--doc/plugins/contrib/compile.mdwn16
1 files changed, 15 insertions, 1 deletions
diff --git a/doc/plugins/contrib/compile.mdwn b/doc/plugins/contrib/compile.mdwn
index 7527f2698..7a3f58539 100644
--- a/doc/plugins/contrib/compile.mdwn
+++ b/doc/plugins/contrib/compile.mdwn
@@ -21,7 +21,9 @@ Some important security notice.
- This plugins allows user to execute arbitrary commands when compiling the
wiki. Use at your own risk. If you use Ikiwiki as a static web site compiler
(and not a wiki), and you are the only one to compile the wiki, there is no
- risk.
+ risk. If you *do* allow untrusted users to edit or comment on the wiki, they
+ can use the `compile` directives to execute completely arbitrary code, regardless
+ of configuration safeguards you may put.
- Source files are published, wheter option `source` is true or not. If
`source` is false, source may not be *advertised*, but it is still available
@@ -30,6 +32,18 @@ Some important security notice.
do not use this plugin if you do not want to publish your source files
(sorry: I designed this plugin to publish free stuff).
+The plugin could be modified to only allow commands to be modified from the
+configuration and it would be safer to use. However, it would still be vulnerable
+to command injection attacks because it uses `qx()` command expansion, which
+runs commands through `/bin/sh -c`. A thorough security review would be in order
+before this should be considered secure running on untrusted input.
+
+A simpler implementation, that only runs a predefined set of commands, may be
+simpler to implement than auditing this whole plugin. For example, the
+[[bibtex2html]] module performs a similar task than the compile module, but
+hardcodes the command used and doesn't call it with `/bin/sh -c`. It could be
+expanded to cover more commands.
+
## Rationale
I want to publish some latex files, both source (`.tex`) and compiled (`.pdf`)