CVE-2013-2060: OS Command Injection

Clayton Coleman reports:

Never use the form in ruby when the variables aren't known to be safe values

def self.downloadfromurl(url) maxdltime = (Rails.application.config.downloadedcartridges[:maxdownloadtime] rescue 10) || 10 maxfilesize = (Rails.application.config.downloadedcartridges[:maxcartsize] rescue 20480) || 20480 maxredirs = (Rails.application.config.downloadedcartridges[:maxdownloadredirects] rescue 2) || 2 curl --max-time #{maxdltime} --connect-timeout 2 --location --max-redirs #{maxredirs} --max-filesize #{maxfilesize} -k #{url} end

If 'URL' is not properly validated, then someone could inject " ; rm -rf /"

In this method, URL needs to be a properly formatted URI with a known whitelist of parameters.

In addition, we should only accept URI's that are of the following whitelisted criteria:

Parses URI successfully Protocol is 'http', 'https', 'git', 'ftp' (I can't think of others that are really safe). 'file' should NOT be allowed Host must be specified, and be non localhost (otherwise you allow a local injection attack). We need to be very careful here not to allow probing of the internal network, so we should only allow addresses that resolve outside of the exsrvs. Port should be valid Path should be valid

If the URI does not meet these criteria an error message should be returned to the user.