From a4b418dd7f30bf14718d4299ae54622f5fbc12cc Mon Sep 17 00:00:00 2001 From: Crazylemon64 Date: Wed, 19 Jul 2017 23:00:55 -0700 Subject: [PATCH 1/2] Closes up stuff in SDQL2 --- code/modules/admin/verbs/SDQL2/SDQL_2.dm | 17 +++++++++++++---- code/modules/admin/verbs/modifyvariables.dm | 12 ++++++++++-- 2 files changed, 23 insertions(+), 6 deletions(-) diff --git a/code/modules/admin/verbs/SDQL2/SDQL_2.dm b/code/modules/admin/verbs/SDQL2/SDQL_2.dm index 84577b51102..7b111e8ed20 100644 --- a/code/modules/admin/verbs/SDQL2/SDQL_2.dm +++ b/code/modules/admin/verbs/SDQL2/SDQL_2.dm @@ -89,7 +89,8 @@ if("delete") for(var/d in objs) - qdel(d) + if(!datum_is_forbidden(d)) + qdel(d) if("select") var/text = "" @@ -117,6 +118,9 @@ if("set" in query_tree) var/list/set_list = query_tree["set"] for(var/d in objs) + // Forbid explicitly modifying an admin datum's vars + if(datum_is_forbidden(d)) + return for(var/list/sets in set_list) var/datum/temp = d var/i = 0 @@ -124,11 +128,11 @@ if(++i == sets.len) if(istype(temp, /turf) && (v == "x" || v == "y" || v == "z")) continue - if(istype(temp.vars[v], /datum/admins)) - continue + if(!datum_is_forbidden(temp.vars[v])) + return temp.vars[v] = SDQL_expression(d, set_list[sets]) break - if(temp.vars.Find(v) && (istype(temp.vars[v], /datum) || istype(temp.vars[v], /client)) && !istype(temp.vars[v], /datum/admins)) + if(temp.vars.Find(v) && (istype(temp.vars[v], /datum) || istype(temp.vars[v], /client)) && !datum_is_forbidden(temp.vars[v])) temp = temp.vars[v] else break @@ -436,6 +440,11 @@ for(var/arg in arguments) new_args[++new_args.len] = SDQL_expression(source, arg) + for(var/p in forbidden_varedit_object_types) + if(istype(object, p)) + to_chat(usr, "It is forbidden to run this object's procs.") + return + if(object == world) // Global proc. procname = "/proc/[procname]" return call(procname)(arglist(new_args)) diff --git a/code/modules/admin/verbs/modifyvariables.dm b/code/modules/admin/verbs/modifyvariables.dm index 8cce4c5a761..cb50d2e6391 100644 --- a/code/modules/admin/verbs/modifyvariables.dm +++ b/code/modules/admin/verbs/modifyvariables.dm @@ -13,6 +13,14 @@ var/list/forbidden_varedit_object_types = list( feedback_add_details("admin_verb","EDITV") //If you are copy-pasting this, ensure the 2nd parameter is unique to the new proc! */ +/proc/datum_is_forbidden(type) + for(var/p in forbidden_varedit_object_types) + if(istype(type, p)) + to_chat(usr, "It is forbidden to tamper with this object.") + return FALSE + return TRUE + + /client/proc/cmd_modify_ticker_variables() set category = "Debug" set name = "Edit Ticker Variables" @@ -131,7 +139,7 @@ var/list/forbidden_varedit_object_types = list( L[var_value] = mod_list_add_ass() //haha if("No") L += var_value - + /client/proc/mod_list(var/list/L) if(!check_rights(R_VAREDIT)) return @@ -497,4 +505,4 @@ var/list/forbidden_varedit_object_types = list( to_chat(usr, "Variable type is UNKNOWN.") class = null - return class \ No newline at end of file + return class From 37270ec7c4b76ee388c15de59d033f496e247132 Mon Sep 17 00:00:00 2001 From: Crazylemon64 Date: Thu, 20 Jul 2017 00:57:42 -0700 Subject: [PATCH 2/2] Paranoid sanitization --- code/__HELPERS/text.dm | 5 ++++- code/_globalvars/configuration.dm | 5 ++++- code/controllers/configuration.dm | 7 +++---- code/modules/ext_scripts/irc.dm | 3 ++- code/modules/ext_scripts/python.dm | 4 ++-- 5 files changed, 15 insertions(+), 9 deletions(-) diff --git a/code/__HELPERS/text.dm b/code/__HELPERS/text.dm index f9bae78c35b..a891ad36a43 100644 --- a/code/__HELPERS/text.dm +++ b/code/__HELPERS/text.dm @@ -59,6 +59,10 @@ /proc/sanitize(var/t,var/list/repl_chars = null) return html_encode(sanitize_simple(t,repl_chars)) +/proc/paranoid_sanitize(t) + var/regex/alphanum_only = regex("\[^a-zA-Z0-9#]", "g") + return alphanum_only.Replace(t, "#") + //Runs sanitize and strip_html_simple //I believe strip_html_simple() is required to run first to prevent '<' from displaying as '<' after sanitize() calls byond's html_encode() /proc/strip_html(var/t,var/limit=MAX_MESSAGE_LEN) @@ -542,4 +546,3 @@ proc/checkhtml(var/t) text = replacetext(text, "", "\[cell\]") text = replacetext(text, "", "\[logo\]") return text - diff --git a/code/_globalvars/configuration.dm b/code/_globalvars/configuration.dm index 2d9b9761523..88d4594e740 100644 --- a/code/_globalvars/configuration.dm +++ b/code/_globalvars/configuration.dm @@ -23,6 +23,9 @@ var/mouse_respawn_time = 5 //Amount of time that must pass between a player dyin // It's defined here as a global because this is a hilariously bad thing to have on the easily-edited config datum var/global/shutdown_shell_command +// Also global to prevent easy edits +var/global/python_path = "" //Path to the python executable. Defaults to "python" on windows and "/usr/bin/env python2" on unix + // Debug is used exactly once (in living.dm) but is commented out in a lot of places. It is not set anywhere and only checked. // Debug2 is used in conjunction with a lot of admin verbs and therefore is actually legit. var/Debug = 0 // global debug switch @@ -44,4 +47,4 @@ var/blobevent = 0 //Medals hub related variables var/global/medal_hub = null var/global/medal_pass = " " -var/global/medals_enabled = TRUE //will be auto set to false if the game fails contacting the medal hub to prevent unneeded calls. \ No newline at end of file +var/global/medals_enabled = TRUE //will be auto set to false if the game fails contacting the medal hub to prevent unneeded calls. diff --git a/code/controllers/configuration.dm b/code/controllers/configuration.dm index ff313e62fb3..0cc5a500d16 100644 --- a/code/controllers/configuration.dm +++ b/code/controllers/configuration.dm @@ -142,7 +142,6 @@ var/admin_irc = "" var/admin_notify_irc = "" var/cidrandomizer_irc = "" - var/python_path = "" //Path to the python executable. Defaults to "python" on windows and "/usr/bin/env python2" on unix var/default_laws = 0 //Controls what laws the AI spawns with. @@ -494,12 +493,12 @@ if("python_path") if(value) - config.python_path = value + python_path = value else if(world.system_type == UNIX) - config.python_path = "/usr/bin/env python2" + python_path = "/usr/bin/env python2" else //probably windows, if not this should work anyway - config.python_path = "pythonw" + python_path = "pythonw" if("assistant_limit") config.assistantlimit = 1 diff --git a/code/modules/ext_scripts/irc.dm b/code/modules/ext_scripts/irc.dm index 05ac226d7e7..c0a25979df2 100644 --- a/code/modules/ext_scripts/irc.dm +++ b/code/modules/ext_scripts/irc.dm @@ -2,7 +2,8 @@ if(config.use_irc_bot && config.irc_bot_host.len) for(var/IP in config.irc_bot_host) spawn(0) - ext_python("ircbot_message.py", "[config.comms_password] [IP] [channel] [msg]") + // I have no means of trusting you, cmd + ext_python("ircbot_message.py", "[config.comms_password] [IP] [channel] [paranoid_sanitize(msg)]") return /proc/send2mainirc(var/msg) diff --git a/code/modules/ext_scripts/python.dm b/code/modules/ext_scripts/python.dm index b10fc691309..6781af866e3 100644 --- a/code/modules/ext_scripts/python.dm +++ b/code/modules/ext_scripts/python.dm @@ -4,6 +4,6 @@ if(world.system_type == MS_WINDOWS) script = replacetext(script, "/", "\\") - var/command = config.python_path + " " + script + " " + args + var/command = python_path + " " + script + " " + args shell("[command]") - return \ No newline at end of file + return