romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-04 17:26:18 +03:00
Code Issues Projects Releases Packages Wiki Activity

sshserver.pl: pass command-line to system() safely

Browse source 
Found by Codex Security

Follow-up to 89f306ae40 #16781

Closes #20996
This commit is contained in:
Viktor Szakats 2026-03-19 01:22:37 +01:00
parent 86c25c06c9
commit 1509b0ce6a
No known key found for this signature in database
1 changed files with 6 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

15
tests/sshserver.pl
View file

@ -397,27 +397,24 @@ if((! -e pp($hstprvkeyf)) || (! -s pp($hstprvkeyf)) ||
unlink(pp($hstprvkeyf), pp($hstpubkeyf), pp($hstpubmd5f),
pp($hstpubsha256f), pp($cliprvkeyf), pp($clipubkeyf));
my $sshkeygenopt = '';
my @sshkeygenopt;
if(($sshid =~ /OpenSSH/) && ($sshvernum >= 560)) {
# Override the default key format. Necessary to force legacy PEM format
# for libssh2 crypto backends that do not understand the OpenSSH (RFC4716)
# format, e.g. WinCNG.
# Accepted values: RFC4716, PKCS8, PEM (see also 'man ssh-keygen')
if($ENV{'CURL_TEST_SSH_KEY_FORMAT'}) {
$sshkeygenopt .= ' -m ' . $ENV{'CURL_TEST_SSH_KEY_FORMAT'};
}
else {
$sshkeygenopt .= ' -m PEM'; # Use the most compatible RSA format for tests.
}
push @sshkeygenopt, '-m';
# Default to the most compatible RSA format for tests.
push @sshkeygenopt, $ENV{'CURL_TEST_SSH_KEY_FORMAT'} ? $ENV{'CURL_TEST_SSH_KEY_FORMAT'} : 'PEM';
}
logmsg "generating host keys...\n" if($verbose);
if(system "\"$sshkeygen\" -q -t rsa -f " . pp($hstprvkeyf) . " -C 'curl test server' -N ''" . $sshkeygenopt) {
if(system($sshkeygen, ('-q', '-t', 'rsa', '-f', pp($hstprvkeyf), '-C', 'curl test server', '-N', '', @sshkeygenopt))) {
logmsg "Could not generate host key\n";
exit 1;
}
display_file_top(pp($hstprvkeyf)) if($verbose);
logmsg "generating client keys...\n" if($verbose);
if(system "\"$sshkeygen\" -q -t rsa -f " . pp($cliprvkeyf) . " -C 'curl test client' -N ''" . $sshkeygenopt) {
if(system($sshkeygen, ('-q', '-t', 'rsa', '-f', pp($cliprvkeyf), '-C', 'curl test client', '-N', '', @sshkeygenopt))) {
logmsg "Could not generate client key\n";
exit 1;
}