Skip to content

Mitigate potential command injection risk (CWE-78) in DhcpClient: avoid dynamic PATH lookup with fixed/safe paths #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
rgfegegeegege wants to merge 1 commit into from
Closed

Mitigate potential command injection risk (CWE-78) in DhcpClient: avoid dynamic PATH lookup with fixed/safe paths #19

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 22 additions & 9 deletions blueman/main/DhcpClient.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
import socket
import subprocess
import logging
from blueman.Functions import have, get_local_interfaces
import shutil # Added for safe executable lookup
from blueman.bluemantyping import GSignals


Expand All @@ -16,10 +16,11 @@ class DhcpClient(GObject.GObject):
'error-occurred': (GObject.SignalFlags.NO_HOOKS, None, (int,)),
}

COMMANDS = [
["dhclient", "-e", "IF_METRIC=100", "-1"],
["dhcpcd", "-m", "100"],
["udhcpc", "-t", "20", "-x", "hostname", socket.gethostname(), "-n", "-i"]
# Fixed/safe paths for common DHCP clients (priority order)
DHCP_CLIENTS = [
"/usr/sbin/dhclient",
"/usr/sbin/dhcpcd",
"/usr/sbin/udhcpc",
]

querying: List[str] = []
Expand All @@ -32,10 +33,22 @@ def __init__(self, interface: str, timeout: int = 30) -> None:
self._timeout = timeout

self._command = None
for command in self.COMMANDS:
path = have(command[0])
if path:
self._command = [path] + command[1:] + [self._interface]
for client_path in self.DHCP_CLIENTS:
# Use shutil.which for safe, realpath-resolved lookup
resolved_path = shutil.which(client_path)
if resolved_path:
# Build command with resolved safe path
if resolved_path.endswith("dhclient"):
self._command = [resolved_path, "-e", "IF_METRIC=100", "-1", self._interface]
elif resolved_path.endswith("dhcpcd"):
self._command = [resolved_path, "-m", "100", self._interface]
elif resolved_path.endswith("udhcpc"):
self._command = [
resolved_path,
"-t", "20",
"-x", "hostname", socket.gethostname(),
"-n", "-i", self._interface
]
break

def run(self) -> None:
Expand Down