From 85182847957497ca4766445e34df5ee7ecf1c8da Mon Sep 17 00:00:00 2001 From: Dirk Wetter Date: Tue, 14 Jan 2020 18:55:09 +0100 Subject: [PATCH 1/4] Try temp file creation in a different location ... if the standard directory /tmp is not allowed to write to. As noted in #1273 this might be the case for Termux on Android. --- testssl.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/testssl.sh b/testssl.sh index 0d07341..c6a55f2 100755 --- a/testssl.sh +++ b/testssl.sh @@ -17194,7 +17194,12 @@ EOF } maketempf() { - TEMPDIR=$(mktemp -d /tmp/testssl.XXXXXX) || exit $ERR_FCREATE + TEMPDIR=$(mktemp -d /tmp/testssl.XXXXXX) + if [[ $? -ne 0 ]]; then + # for e.g. devices where we can't write to /tmp: + TEMPPATH=$PWD + TEMPDIR=$(mktemp -d $PWD/testssl.XXXXXX) || exit $ERR_FCREATE + fi TMPFILE=$TEMPDIR/tempfile.txt || exit $ERR_FCREATE if [[ "$DEBUG" -eq 0 ]]; then ERRFILE="/dev/null" From f0f8f3a318f4fbf608eca53b538091c17c8524f5 Mon Sep 17 00:00:00 2001 From: Dirk Wetter Date: Tue, 14 Jan 2020 20:09:46 +0100 Subject: [PATCH 2/4] Remove TEMPPATH, make sure PWD doesn't contain a blank --- testssl.sh | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/testssl.sh b/testssl.sh index c6a55f2..9d0cef4 100755 --- a/testssl.sh +++ b/testssl.sh @@ -17197,8 +17197,11 @@ maketempf() { TEMPDIR=$(mktemp -d /tmp/testssl.XXXXXX) if [[ $? -ne 0 ]]; then # for e.g. devices where we can't write to /tmp: - TEMPPATH=$PWD - TEMPDIR=$(mktemp -d $PWD/testssl.XXXXXX) || exit $ERR_FCREATE + if [[ $PWD =~ \ ]]; then + # We can't allow this as we haven't quoted all strings depending on it, see #1445 + fatal "\$PWD contains a blank: \"$PWD\"" $ERR_FCREATE + fi + TEMPDIR=$(mktemp -d "PWD/testssl.XXXXXX") || exit $ERR_FCREATE fi TMPFILE=$TEMPDIR/tempfile.txt || exit $ERR_FCREATE if [[ "$DEBUG" -eq 0 ]]; then From 50c9075ba8167e9209e20d6f092ceca0010fe7af Mon Sep 17 00:00:00 2001 From: Dirk Wetter Date: Tue, 14 Jan 2020 20:41:08 +0100 Subject: [PATCH 3/4] Provide whitelist for $PWD see #1445 --- testssl.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/testssl.sh b/testssl.sh index 9d0cef4..585f6d3 100755 --- a/testssl.sh +++ b/testssl.sh @@ -17196,10 +17196,10 @@ EOF maketempf() { TEMPDIR=$(mktemp -d /tmp/testssl.XXXXXX) if [[ $? -ne 0 ]]; then - # for e.g. devices where we can't write to /tmp: - if [[ $PWD =~ \ ]]; then - # We can't allow this as we haven't quoted all strings depending on it, see #1445 - fatal "\$PWD contains a blank: \"$PWD\"" $ERR_FCREATE + # For e.g. devices where we can't write to /tmp we chose $PWD but we can't + # allow every char as we haven't quoted all strings depending on it, see #1445 + if [[ $PWD =~ ^[A-Za-z0-9\.,-/_]+$ ]]; then + fatal "\$PWD contains illegal chars: \"$PWD\"" $ERR_FCREATE fi TEMPDIR=$(mktemp -d "PWD/testssl.XXXXXX") || exit $ERR_FCREATE fi From 50ea6b18918cf4cccbfb5ec4027e64824cb6d21f Mon Sep 17 00:00:00 2001 From: Dirk Wetter Date: Tue, 14 Jan 2020 22:52:47 +0100 Subject: [PATCH 4/4] $PWD check : negate pattern + add $BASH_REMATCH --- testssl.sh | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/testssl.sh b/testssl.sh index 585f6d3..80878d2 100755 --- a/testssl.sh +++ b/testssl.sh @@ -17198,10 +17198,10 @@ maketempf() { if [[ $? -ne 0 ]]; then # For e.g. devices where we can't write to /tmp we chose $PWD but we can't # allow every char as we haven't quoted all strings depending on it, see #1445 - if [[ $PWD =~ ^[A-Za-z0-9\.,-/_]+$ ]]; then - fatal "\$PWD contains illegal chars: \"$PWD\"" $ERR_FCREATE + if [[ $PWD =~ [^A-Za-z0-9\.,/_-] ]]; then + fatal "\$PWD contains illegal chars: \"$BASH_REMATCH\"" $ERR_FCREATE fi - TEMPDIR=$(mktemp -d "PWD/testssl.XXXXXX") || exit $ERR_FCREATE + TEMPDIR=$(mktemp -d "$PWD/testssl.XXXXXX") || exit $ERR_FCREATE fi TMPFILE=$TEMPDIR/tempfile.txt || exit $ERR_FCREATE if [[ "$DEBUG" -eq 0 ]]; then @@ -20002,8 +20002,8 @@ lets_roll() { initialize_globals check_base_requirements # needs to come after $do_html is defined parse_cmd_line "$@" - # CMDLINE_PARSED has been set now. Don't put a now function after this which calls fatal(). Rather - # put it after csv_header below + # CMDLINE_PARSED has been set now. Don't put a function immediately after this which calls fatal(). + # Rather put it after csv_header below. # html_header() needs to be called early! Otherwise if html_out() is called before html_header() and the # command line contains --htmlfile or --html, it'll make problems with html output, see #692. # json_header and csv_header could be called later but for context reasons we'll leave it here