commit 1902990db9c36a8c2f4a57a4389c1a0c74658584
author Gunnar Mills <gmills@us.ibm.com> Fri Oct 06 14:47:10 2017 -0500
committer Brad Bishop <bradleyb@fuzziesquirrel.com> Tue Oct 24 13:42:45 2017 +0000
tree 256c223fa82e16ff540bade4123adce5ec44ebe3
parent 1be4fabdcb00d17f3b4dc2b563125e661692948d

Add basename for file name in download manager

Added getting the basename for the output file name in
download manager. This is to prevent any security holes
that would let the user out of the FLASH_DOWNLOAD_PATH dir.
(e.g. passing a file name of ../etc/shadow)

Resolves openbmc/openbmc#1898

Change-Id: Ie33fe56599e86c29da4b2eae8ef070f0866d054c
Signed-off-by: Gunnar Mills <gmills@us.ibm.com>

pydownloadmgr/download_manager.py

diff --git a/pydownloadmgr/download_manager.py b/pydownloadmgr/download_manager.py
index 3cc9f28..7ba80ca 100644
--- a/pydownloadmgr/download_manager.py
+++ b/pydownloadmgr/download_manager.py
@@ -1,5 +1,6 @@
 #!/usr/bin/env python
 
+import os
 import gobject
 import dbus
 import dbus.service
@@ -40,7 +41,7 @@
         try:
             filename = str(filename)
             print "Downloading: "+filename+" from "+ip
-            outfile = FLASH_DOWNLOAD_PATH+"/"+filename
+            outfile = FLASH_DOWNLOAD_PATH+"/"+os.path.basename(filename)
             rc = subprocess.call(
                 ["tftp", "-l", outfile, "-r", filename, "-g", ip])
             if (rc == 0):
@@ -58,7 +59,7 @@
         try:
             filename = str(filename)
             print "Downloading: "+filename+" from "+url
-            outfile = FLASH_DOWNLOAD_PATH+"/"+filename
+            outfile = FLASH_DOWNLOAD_PATH+"/"+os.path.basename(filename)
             subprocess.call(
                 ["tftp", "-l", outfile, "-r", filename, "-g", url])
             obj = bus.get_object("org.openbmc.control.Flash", path)