TypeError: execv() arg 2 must contain only strings

[Ryan J Ollos]

From the logs:

[pid 7564 139730844530432] 2016-03-14 16:05:09,876 Trac[main] ERROR: Internal Server Error: <RequestWithSession "GET '/changeset?new=302bd3796163449f419a328fb5ce566b6cc55948@/&old=14519%2540/<%00ScRiPt%20%0d%0a>prompt(937841)</ScRiPt>&reponame=psuter.git&sfph_mail=&sfp_email=sample@email.tst'">, referrer 'http://trac.edgewall.org/'
Traceback (most recent call last):
  File "/usr/local/virtualenv/1.1dev/lib/python2.7/site-packages/trac/web/main.py", line 607, in _dispatch_request
    dispatcher.dispatch(req)
  File "/usr/local/virtualenv/1.1dev/lib/python2.7/site-packages/trac/web/main.py", line 256, in dispatch
    resp = chosen_handler.process_request(req)
  File "/usr/local/virtualenv/1.1dev/lib/python2.7/site-packages/trac/versioncontrol/web_ui/changeset.py", line 256, in process_request
    old = repos.normalize_rev(old or new)
  File "/usr/local/virtualenv/1.1dev/lib/python2.7/site-packages/tracopt/versioncontrol/git/git_fs.py", line 534, in normalize_rev
    normrev = self.git.verifyrev(rev)
  File "/usr/local/virtualenv/1.1dev/lib/python2.7/site-packages/tracopt/versioncontrol/git/PyGIT.py", line 717, in verifyrev
    rc = self.repo.rev_parse('--verify', rev).strip()
  File "/usr/local/virtualenv/1.1dev/lib/python2.7/site-packages/tracopt/versioncontrol/git/PyGIT.py", line 139, in __execute
    p = self.__pipe(git_cmd, stdout=PIPE, stderr=PIPE, *cmd_args)
  File "/usr/local/virtualenv/1.1dev/lib/python2.7/site-packages/tracopt/versioncontrol/git/PyGIT.py", line 132, in __pipe
    close_fds=close_fds, **kw)
  File "/usr/lib/python2.7/subprocess.py", line 710, in __init__
    errread, errwrite)
  File "/usr/lib/python2.7/subprocess.py", line 1335, in _execute_child
    raise child_exception
TypeError: execv() arg 2 must contain only strings

This looks to be similar to #11291.

[Jun Omae]

Null byte attack. This issue is caused by passing null byte to Popen().

>>> from subprocess import Popen
>>> Popen(('/bin/echo', '123')).wait()
123
0
>>> Popen(('/bin/echo', '12\x003')).wait()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python2.7/subprocess.py", line 710, in __init__
    errread, errwrite)
  File "/usr/lib/python2.7/subprocess.py", line 1327, in _execute_child
    raise child_exception
TypeError: execv() arg 2 must contain only strings

It seems os.exec* family disallows null bytes.

$ LANG=C python -c "import os; os.execv('/bin/echo', ('/bin/echo', '123'))"
123
$ LANG=C python -c "import os; os.execv('/bin/echo', ('/bin/echo', '1\x0023'))"
Traceback (most recent call last):
  File "<string>", line 1, in <module>
TypeError: execv() arg 2 must contain only strings
$
$ LANG=en_US.UTF-8 python -c "import os; os.execv('/bin/echo', ('/bin/echo', '123'))"
123
$ LANG=en_US.UTF-8 python -c "import os; os.execv('/bin/echo', ('/bin/echo', '1\x0023'))"
Traceback (most recent call last):
  File "<string>", line 1, in <module>
TypeError: execv() arg 2 must contain only strings

[Jun Omae]

I think we could reject such a request with null bytes.

trac/web/api.py

@@ -729 +729 @@
         args = []
         for value in fs.list or ():
             try:
-                name = unicode(value.name, 'utf-8')
-                if not value.filename:
-                    value = unicode(value.value, 'utf-8')
+                name = value.name
+                if '\x00' in name:
+                    raise HTTPBadRequest(_("Invalid request arguments."))
+                name = unicode(name, 'utf-8')
+                if value.filename:
+                    if '\x00' in value.filename:
+                        raise HTTPBadRequest(_("Invalid request arguments."))
+                else:
+                    value = value.value
+                    if '\x00' in value:
+                        raise HTTPBadRequest(_("Invalid request arguments."))
+                    value = unicode(value, 'utf-8')
             except UnicodeDecodeError, e:
                 raise HTTPBadRequest(
                     _("Invalid encoding in form data: %(msg)s",

[Ryan J Ollos]

#12404 closed as a duplicate.

[Ryan J Ollos]

Thanks for the patch. I added tests in log:rjollos.git:t12403.

[Ryan J Ollos]

Committed to 1.0-stable in [14609], merged to trunk in [14610].