internet/community.general
3
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2026-05-06 13:22:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Disallow use of remote home directories containing .. in their path (CVE-2019-3828) (#52133)

Browse Source 
* Disallow use of remote home directories containing .. in their path

* Add CVE to changelog
This commit is contained in:
Matt Martz
2019-02-13 10:38:28 -06:00
committed by GitHub
parent 9f081ca04f
commit b34d141eed
3 changed files with 44 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
lib/ansible/plugins/action/__init__.py
View File

@@ -635,6 +635,9 @@ class ActionBase(with_metaclass(ABCMeta, object)):
else:
expanded = initial_fragment
if '..' in os.path.dirname(expanded).split('/'):
raise AnsibleError("'%s' returned an invalid relative home directory path containing '..'" % self._play_context.remote_addr)
return expanded
def _strip_success_message(self, data):