3diy
/
moonraker
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

git_deploy: refuse recovery if repo is not verified 

Close a security hole where an attacker could overwrite an existing repo
with any remote and run malicious code through an update.

Signed-off-by:  Eric Callahan <arksine.code@gmail.com>
This commit is contained in:
Eric Callahan 2022-07-28 14:35:48 -04:00
parent b5e7a5ba5a
commit 4b25b04c4f
No known key found for this signature in database
GPG Key ID: 5A1EB336DFB4C71B
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
moonraker/components/update_manager/git_deploy.py
View File

@ -284,6 +284,9 @@ class GitRepo:
'commits_behind', []) 'commits_behind', [])
self.tag_data: Dict[str, Any] = storage.get('tag_data', {}) self.tag_data: Dict[str, Any] = storage.get('tag_data', {})
self.diverged: bool = storage.get("diverged", False) self.diverged: bool = storage.get("diverged", False)
self.repo_veriified: bool = storage.get(
"verified", storage.get("is_valid", False)
)
def get_persistent_data(self) -> Dict[str, Any]: def get_persistent_data(self) -> Dict[str, Any]:
return { return {
@ -304,7 +307,8 @@ class GitRepo:
'git_messages': self.git_messages, 'git_messages': self.git_messages,
'commits_behind': self.commits_behind, 'commits_behind': self.commits_behind,
'tag_data': self.tag_data, 'tag_data': self.tag_data,
'diverged': self.diverged 'diverged': self.diverged,
'verified': self.repo_veriified
} }
async def initialize(self, need_fetch: bool = True) -> None: async def initialize(self, need_fetch: bool = True) -> None:
@ -622,6 +626,8 @@ class GitRepo:
invalids.append("Detached HEAD detected") invalids.append("Detached HEAD detected")
if self.diverged: if self.diverged:
invalids.append("Repo has diverged from remote") invalids.append("Repo has diverged from remote")
if not invalids:
self.repo_veriified = True
return invalids return invalids
def _verify_repo(self, check_remote: bool = False) -> None: def _verify_repo(self, check_remote: bool = False) -> None:
@ -720,6 +726,10 @@ class GitRepo:
async def clone(self) -> None: async def clone(self) -> None:
async with self.git_operation_lock: async with self.git_operation_lock:
if not self.repo_veriified:
raise self.server.error(
"Repo has not been verified, clone aborted"
)
self.cmd_helper.notify_update_response( self.cmd_helper.notify_update_response(
f"Git Repo {self.alias}: Starting Clone Recovery...") f"Git Repo {self.alias}: Starting Clone Recovery...")
event_loop = self.server.get_event_loop() event_loop = self.server.get_event_loop()