From 3401e8e54b0164afce799c76507de387532d0c71 Mon Sep 17 00:00:00 2001
From: TheFakeElon <59686430+TheFakeElon@users.noreply.github.com>
Date: Fri, 17 Sep 2021 05:12:42 +1000
Subject: [PATCH] [s] fail2topic vulnerability (#12499)

---
 code/controllers/subsystems/fail2topic.dm           | 11 +++++++----
 code/modules/admin/verbs/SDQL_2.dm                  |  4 ++++
 code/modules/admin/view_variables/view_variables.dm |  4 ++++
 3 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/code/controllers/subsystems/fail2topic.dm b/code/controllers/subsystems/fail2topic.dm
index 722f9078bfc..562185b22fe 100644
--- a/code/controllers/subsystems/fail2topic.dm
+++ b/code/controllers/subsystems/fail2topic.dm
@@ -11,7 +11,6 @@ var/datum/controller/subsystem/fail2topic/SSfail2topic
 
 	var/rate_limit
 	var/max_fails
-	var/rule_name
 	var/enabled = FALSE
 
 /datum/controller/subsystem/fail2topic/New()
@@ -20,7 +19,6 @@ var/datum/controller/subsystem/fail2topic/SSfail2topic
 /datum/controller/subsystem/fail2topic/Initialize(timeofday)
 	rate_limit = config.fail2topic_rate_limit
 	max_fails = config.fail2topic_max_fails
-	rule_name = config.fail2topic_rule_name
 	enabled = config.fail2topic_enabled
 
 	DropFirewallRule() // Clear the old bans if any still remain
@@ -84,12 +82,17 @@ var/datum/controller/subsystem/fail2topic/SSfail2topic
 /datum/controller/subsystem/fail2topic/proc/BanFromFirewall(ip)
 	if (!enabled)
 		return
+	var/static/regex/R = regex(@"^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$") // Anything that interacts with a shell should be parsed. Prevents subnet banning and possible injection vulnerabilities
+	ip = findtext(ip, R)
+	if(length(ip) > 15 || length(ip) < 8)
+		WARNING("BanFromFirewall was called with an invalid or unsafe IP")
+		return FALSE
 
 	active_bans[ip] = world.time
 	fail_counts -= ip
 	rate_limiting -= ip
 
-	. = shell("netsh advfirewall firewall add rule name=\"[rule_name]\" dir=in interface=any action=block remoteip=[ip]")
+	. = shell("netsh advfirewall firewall add rule name=\"[config.fail2topic_rule_name]\" dir=in interface=any action=block remoteip=[ip]")
 
 	if (.)
 		log_ss("fail2topic", "Failed to ban [ip]. Exit code: [.].", log_world = FALSE, severity = SEVERITY_ERROR)
@@ -104,7 +107,7 @@ var/datum/controller/subsystem/fail2topic/SSfail2topic
 
 	active_bans = list()
 
-	. = shell("netsh advfirewall firewall delete rule name=\"[rule_name]\"")
+	. = shell("netsh advfirewall firewall delete rule name=\"[config.fail2topic_rule_name]\"")
 
 	if (.)
 		log_ss("fail2topic", "Failed to drop firewall rule. Exit code: [.].", log_world = FALSE, severity = SEVERITY_ERROR)
diff --git a/code/modules/admin/verbs/SDQL_2.dm b/code/modules/admin/verbs/SDQL_2.dm
index 5b71b526b95..06568b45ab1 100644
--- a/code/modules/admin/verbs/SDQL_2.dm
+++ b/code/modules/admin/verbs/SDQL_2.dm
@@ -58,6 +58,10 @@
 				objs += d
 
 	//to_chat(usr, "Query: [query_text]")
+	var/static/list/blacklist = list(/datum/configuration)
+	for(var/datum/D in objs)
+		if(blacklist[D.type])
+			objs -= D
 	message_admins("[usr] executed SDQL query: \"[query_text]\".")
 
 	switch(query_tree[1])
diff --git a/code/modules/admin/view_variables/view_variables.dm b/code/modules/admin/view_variables/view_variables.dm
index 26f914e823e..f66579fa899 100644
--- a/code/modules/admin/view_variables/view_variables.dm
+++ b/code/modules/admin/view_variables/view_variables.dm
@@ -21,6 +21,10 @@
 	if(!D)
 		return
 
+	var/static/list/blacklist = list(/datum/configuration)
+	if(blacklist[D.type])
+		return
+
 	var/icon/sprite
 	if(istype(D, /atom))
 		var/atom/A = D