From f620d338da83d9004382892639d2e1b32338a685 Mon Sep 17 00:00:00 2001 From: zhangkun2 Date: Fri, 30 Oct 2026 12:47:20 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=20autostop=20?= =?UTF-8?q?=E8=84=9A=E6=9C=AC=20CWE-78=20=E5=91=BD=E4=BB=A4=E6=B3=A8?= =?UTF-8?q?=E5=85=A5=E6=BC=8F=E6=B4=9E?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 将 bash -c 改为 bash ，消除命令注入向量； 增加属主/权限校验（lstat、符号链接跳过、group/other 可写检查）。 Log: 修复安全漏洞 CWE-78 --- src/dde-session/impl/sessionmanager.cpp | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/src/dde-session/impl/sessionmanager.cpp b/src/dde-session/impl/sessionmanager.cpp index cd69dfe..155ddea 100644 --- a/src/dde-session/impl/sessionmanager.cpp +++ b/src/dde-session/impl/sessionmanager.cpp @@ -22,6 +22,7 @@ #include #include +#include #include using namespace Dtk::Core; @@ -617,16 +618,35 @@ void SessionManager::stopLangSelector() void SessionManager::launchAutostopScripts() { + const QString userConfigPath = + QStandardPaths::standardLocations(QStandardPaths::ConfigLocation).first(); + QStringList paths; - paths.append(QStandardPaths::standardLocations(QStandardPaths::ConfigLocation).first()+ QDir::separator() + "autostop"); + paths.append(userConfigPath + QDir::separator() + "autostop"); paths.append("/etc/xdg/autostop"); for (auto path : paths) { QDir scriptDir(path); const QFileInfoList &fileInfos = scriptDir.entryInfoList(QDir::Files); for (auto info : fileInfos) { + // 跳过符号链接，防止指向非预期文件 + if (info.isSymLink()) { + qWarning() << "[autostop] skip symlink:" << info.absoluteFilePath(); + continue; + } + // 校验属主和权限：禁止 group/other 可写 + struct stat st; + if (lstat(info.absoluteFilePath().toLocal8Bit().constData(), &st) != 0) { + qWarning() << "[autostop] lstat failed:" << info.absoluteFilePath(); + continue; + } + const uid_t expectedUid = path.startsWith(userConfigPath) ? getuid() : 0; + if (st.st_uid != expectedUid || (st.st_mode & (S_IWGRP | S_IWOTH))) { + qWarning() << "[autostop] skip unsafe file (owner/permission):" << info.absoluteFilePath(); + continue; + } qDebug() << "[autostop] script will be launched: " << info.absoluteFilePath(); - EXEC_COMMAND("/bin/bash", QStringList() << "-c" << info.absoluteFilePath()); + EXEC_COMMAND("/bin/bash", QStringList() << info.absoluteFilePath()); } } }