2018-06-18 18:25:55 +00:00
|
|
|
Spent several hours dealing with the problem of http proxies, which
|
|
|
|
|
bypassed the IP address checks added to prevent the security hole.
|
|
|
|
|
Eventually got it filtering out http proxies located on private IP
|
|
|
|
|
addresses.
|
|
|
|
|
|
|
|
|
|
Other than the question of what to do about external special remotes
|
|
|
|
|
that may be vulerable to related problems, it looks like the security
|
|
|
|
|
hole is all closed off in git-annex now.
|
|
|
|
|
|
|
|
|
|
Added a new page [[security]] with details of this and past security holes
|
|
|
|
|
in git-annex.
|
|
|
|
|
|
|
|
|
|
Several people I reached out to for help with special remotes have gotten
|
|
|
|
|
back to me, and we're discussing how the security hole may affect them and
|
|
|
|
|
what to do. Thanks especially to Robie Basak and Daniel Dent for their
|
|
|
|
|
work on security analysis.
|
2018-06-18 22:01:33 +00:00
|
|
|
|
|
|
|
|
Also prepared a minimal backport of the security fixes for the git-annex in
|
|
|
|
|
Debian stable, which will probably be more palatable to their security team
|
|
|
|
|
than the full 2000+ lines of patches I've developed so far.
|
|
|
|
|
The minimal fix is secure, but suboptimal; it prevents even safe urls from
|
|
|
|
|
being downloaded from the web special remote by default.
|
2018-06-21 16:28:39 +00:00
|
|
|
|
|
|
|
|
[[!meta date="June 18 2018 4:00 pm"]]
|
