Critical vulnerability of NPM package macaddress

Re:Critical vulnerability of NPM package macaddress by amluto on Monday June 11, 2018 @11:56AM (#17285328)

> after verifying that the iface parameter does not contain a directory separator.

No, this is terrible practice. The correct solution is to verify that the interface name is well formed. Use a whitelist, not a blacklist. And, for good measure, use a real path manipulation library if available.

[ Parent | on HN ]

Re:Critical vulnerability of NPM package macaddress by okdana on Monday June 11, 2018 @12:18PM (#17285572)

How are you going to white-list network-interface names? On Linux at least you can name them almost anything you want:

  % sudo ip link set eth3 down
  % sudo ip link set eth3 name "'deal-with-it'"
  % sudo ip link show "'deal-with-it'"
  5: 'deal-with-it': <BROADCAST,MULTICAST> mtu 1500 qdisc mq state DOWN mode DEFAULT group default qlen 10000
      link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff

The only interface-name restrictions iproute2 sets is that they can't contain NUL, slash, or white space, and they can't be longer than 15 characters.

[ Parent | on HN ]

Re:Critical vulnerability of NPM package macaddress by tedunangst on Monday June 11, 2018 @12:36PM (#17285814)

So I guess the question is does a regex of [^/ ]{1,15} count as a whitelist or a blacklist?

[ Parent | on HN ]

Re:Critical vulnerability of NPM package macaddress by amluto on Wednesday June 13, 2018 @02:23PM (#17305731)

So does Linux allow .. as an interface name? If so, that’s nuts.

[ Parent | on HN ]