If it enounters a file type it does not understand, ikiwiki just copies it
into place. So if you let users add any kind of file they like, they can
-upload images, movies, windows executables, css files, etc. If these files exploit security holes in the browser of someone who's viewing the wiki, that can be a security problem.
+upload images, movies, windows executables, css files, etc. If these files
+exploit security holes in the browser of someone who's viewing the wiki,
+that can be a security problem.
Of course nobody else seems to worry about this in other wikis, so should we?
## multiple accessors of wiki directory
-If multiple people can write to the source directory ikiwiki is using, or to the destination directory it writes files to, then one can cause trouble for the other when they run ikiwiki through symlink attacks.
+If multiple people can write to the source directory ikiwiki is using, or
+to the destination directory it writes files to, then one can cause trouble
+for the other when they run ikiwiki through symlink attacks.
So it's best if only one person can ever write to those directories.
## svn commit logs
-Anyone with svn commit access can forge "web commit from foo" and make it appear on [[RecentChanges]] like foo committed. One way to avoid this would be to limit web commits to those done by a certian user.
+Anyone with svn commit access can forge "web commit from foo" and make it
+appear on [[RecentChanges]] like foo committed. One way to avoid this would
+be to limit web commits to those done by a certian user.
It's actually possible to force a whole series of svn commits to appear to
have come just before yours, by forging svn log output. This could be
ikiwiki does not expose untrusted data to the shell. In fact it doesn't use
system() at all, and the only use of backticks is on data supplied by the
-wiki admin and untainted filenames. And it runs with taint checks on of course..
+wiki admin and untainted filenames. And it runs with taint checks on of
+course..
## cgi data security
# Fixed holes
-_(Unless otherwise noted, these were discovered and immediatey fixed by the ikiwiki developers.)_
+_(Unless otherwise noted, these were discovered and immediatey fixed by the
+ikiwiki developers.)_
## destination directory file replacement
again when saving the changed page.
This was fixed by making ikiwiki refuse to read or write to files that are
-symlinks, combined with the above locking.
+symlinks, or that are in subdirectories that are symlinks, combined with
+the above locking.
+
+## underlaydir override attacks
+
+ikiwiki also scans an underlaydir for pages, this is used to provide stock
+pages to all wikis w/o needing to copy them into the wiki. Since ikiwiki
+internally stores only the base filename from the underlaydir or srcdir,
+and searches for a file in either directory when reading a page source,
+there is the potential for ikiwiki's scanner to reject a file from the
+srcdir for some reason (such as it being a symlink), find a valid copy of
+the file in the underlaydir, and then when loading the file, mistekenly
+load the bad file from the srcdir.
+
+This attack is avoided by making ikiwiki scan the srcdir first, and refuse
+to add any files from the underlaydir if a file also exists in the srcdir
+with the same name. **But**, note that this assumes that any given page can
+be produced from a file with only one name (`page.mdwn` => `page.html`).
+
+If it's possible for files with different names to produce a given page, it
+would still be possible to use this attack to confuse ikiwiki into
+rendering the wrong thing. This is not currently possible, but must be kept
+in mind in the future when for example adding support for generating html
+pages from source with some other extension.
sipb-www / ikiwiki.git / blobdiff