Copy/Paste

Programmers discuss here anything related to FreeOrion programming. Primarily for the developers to discuss.

Moderators: Committer, Committer

Message
Author
User avatar
adrian_broher
Programmer
Posts: 1082
Joined: Fri Mar 01, 2013 9:52 am
Location: Germany

Re: Copy/Paste

#16 Post by adrian_broher » Thu Jul 16, 2015 1:47 pm

Geoff the Medio wrote:That looks a bit unsafe / exploitable...
How? The URLs passed are well known and static. It's not like we're passing content from a potential malicious server or other clients through the system call.
Resident code gremlin
Attached patches are released under GPL 2.0 or later.
Git author: Marcel Metz

User avatar
Geoff the Medio
Programming, Design, Admin
Posts: 12422
Joined: Wed Oct 08, 2003 1:33 am
Location: Munich

Re: Copy/Paste

#17 Post by Geoff the Medio » Thu Jul 16, 2015 2:38 pm

adrian_broher wrote:The URLs passed are well known and static. It's not like we're passing content from a potential malicious server or other clients through the system call.
Exactly that could happen, if a player connects to a server with modified content files. Also, players can currently put markup into, for example, ship names, and these will be processed and turned into clickable links in sitrep messages. Markup is also processed by the messages window, but it doesn't turn them into links, although in future it probably could / should also be capable of showing clickable links.

Even if those particular "holes" are fixed, somehow without limiting functionality, others might be missed... and so I think it'd be safer to call something URL-specific (which I suppose can also be exploited if sending someone to a suitable website, but at least it's a bit safer than opening arbitrary files on the local system...)

User avatar
adrian_broher
Programmer
Posts: 1082
Joined: Fri Mar 01, 2013 9:52 am
Location: Germany

Re: Copy/Paste

#18 Post by adrian_broher » Thu Jul 16, 2015 3:19 pm

You're moving goalposts here.
Would be nice to have links to freeorion.org or copyright text websites work from in-game.
Geoff the Medio wrote:Exactly that could happen, if a player connects to a server with modified content files.
Neither the COPYING file nor the freeorion url are fetched from the server.
Also, players can currently put markup into, for example, ship names, and these will be processed and turned into clickable links in sitrep messages.
How is this internal mechanism even related to the links you want to handle?
Resident code gremlin
Attached patches are released under GPL 2.0 or later.
Git author: Marcel Metz

User avatar
Geoff the Medio
Programming, Design, Admin
Posts: 12422
Joined: Wed Oct 08, 2003 1:33 am
Location: Munich

Re: Copy/Paste

#19 Post by Geoff the Medio » Thu Jul 16, 2015 3:25 pm

I'm assuming links to websites in arbitrary text will be implemented with markup just like intra-pedia or sitrep-to-pedia type links.

Sitreps can contain player-written text (names), and after modifications Dilvish is working on now, arbitrary sitrep text could be sent without fetching from the client-side stringtable.

User avatar
em3
Vacuum Dragon
Posts: 578
Joined: Sun Sep 25, 2011 2:51 pm

Re: Copy/Paste

#20 Post by em3 » Thu Jul 16, 2015 6:22 pm

You can hardcode a whitelist of command patterns allowed (i.e. only URLs that point to freeorion.org - based sites). Or add it to client configuration.
[...] for Man has earned his right to hold this planet against all comers, by virtue of occasionally producing someone totally batshit insane. - Randall Munroe, title text to xkcd #556

User avatar
Dilvish
AI Lead, Programmer
Posts: 4768
Joined: Sat Sep 22, 2012 6:25 pm

Re: Copy/Paste

#21 Post by Dilvish » Thu Jul 16, 2015 8:01 pm

em3 wrote:You can hardcode a whitelist of command patterns allowed (i.e. only URLs that point to freeorion.org - based sites). Or add it to client configuration.
Seems like something along those lines should be safe enough.
If I provided any code, scripts or other content here, it's released under GPL 2.0 and CC-BY-SA 3.0

User avatar
Geoff the Medio
Programming, Design, Admin
Posts: 12422
Joined: Wed Oct 08, 2003 1:33 am
Location: Munich

Re: Copy/Paste

#22 Post by Geoff the Medio » Fri Aug 28, 2015 8:32 pm

I made a pull request attempting to implement the OpenURL function as suggested earlier. Testing would be helpful...

https://github.com/freeorion/freeorion/pull/318

Post Reply