[tor-commits] [tor/master] Remove commas and equals signs from external string inputs to the fallback list

[nickm at torproject.org]

commit beedf5fd81c25e67655432e009b047252cd0a970
Author: teor <teor2345 at gmail.com>
Date:   Sun Dec 24 11:24:29 2017 +1100

    Remove commas and equals signs from external string inputs to the fallback list
    
    This makes sure that list parsers only see one comma per fallback entry,
    and only see one equals sign per field.
    
    Implements ticket 24726.
---
 changes/ticket24726                 | 4 ++++
 scripts/maint/updateFallbackDirs.py | 8 ++++++++
 2 files changed, 12 insertions(+)

diff --git a/changes/ticket24726 b/changes/ticket24726
new file mode 100644
index 000000000..2bbdfa91a
--- /dev/null
+++ b/changes/ticket24726
@@ -0,0 +1,4 @@
+  o Minor features (fallback directory mirrors):
+    - Remove commas and equals signs from external string inputs to the
+      fallback list. This avoids format confusion attacks.
+      Implements ticket 24726.
diff --git a/scripts/maint/updateFallbackDirs.py b/scripts/maint/updateFallbackDirs.py
index d1f50c70c..52ae886bd 100755
--- a/scripts/maint/updateFallbackDirs.py
+++ b/scripts/maint/updateFallbackDirs.py
@@ -284,6 +284,10 @@ def cleanse_c_multiline_comment(raw_string):
   bad_char_list = '*/'
   # Prevent a malicious string from using C nulls
   bad_char_list += '\0'
+  # Avoid confusing parsers by making sure there is only one comma per fallback
+  bad_char_list += ','
+  # Avoid confusing parsers by making sure there is only one equals per field
+  bad_char_list += '='
   # Be safer by removing bad characters entirely
   cleansed_string = remove_bad_chars(cleansed_string, bad_char_list)
   # Some compilers may further process the content of comments
@@ -304,6 +308,10 @@ def cleanse_c_string(raw_string):
   bad_char_list += '\\'
   # Prevent a malicious string from using C nulls
   bad_char_list += '\0'
+  # Avoid confusing parsers by making sure there is only one comma per fallback
+  bad_char_list += ','
+  # Avoid confusing parsers by making sure there is only one equals per field
+  bad_char_list += '='
   # Be safer by removing bad characters entirely
   cleansed_string = remove_bad_chars(cleansed_string, bad_char_list)
   # Some compilers may further process the content of strings