c1a6e94726
attacker to enumerate filesystem contents. See: http://blog.liftsecurity.io/post/35714931664/filesystem-enumeration-using-redis-and-lua While here, fix a pasto in redis.conf: "syslog-enabled no" where "syslog-enabled yes" was intended.
18 lines
677 B
Plaintext
18 lines
677 B
Plaintext
$OpenBSD: patch-src_scripting_c,v 1.1 2012/11/26 15:24:13 dcoppa Exp $
|
|
|
|
Remove dofile() from Redis Lua scripting, because it allows an
|
|
attacker to enumerate filesystem contents. See:
|
|
http://blog.liftsecurity.io/post/35714931664/filesystem-enumeration-using-redis-and-lua
|
|
|
|
--- src/scripting.c.orig Mon Nov 26 16:45:10 2012
|
|
+++ src/scripting.c Mon Nov 26 16:46:01 2012
|
|
@@ -480,6 +480,8 @@ void luaLoadLibraries(lua_State *lua) {
|
|
void luaRemoveUnsupportedFunctions(lua_State *lua) {
|
|
lua_pushnil(lua);
|
|
lua_setglobal(lua,"loadfile");
|
|
+ lua_pushnil(lua);
|
|
+ lua_setglobal(lua,"dofile");
|
|
}
|
|
|
|
/* This function installs metamethods in the global table _G that prevent
|