From bb8137062f3ea698d39ca25b86b44b9c3cc12dde Mon Sep 17 00:00:00 2001
From: Steven Barth <steven@midlink.org>
Date: Mon, 1 Sep 2008 16:05:34 +0000
Subject: [PATCH] libs/web: Added several sanity checks to avoid local
 privilege escalation

---
 libs/web/luasrc/dispatcher.lua |  8 ++++++++
 libs/web/luasrc/sauth.lua      | 10 ++++++----
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/libs/web/luasrc/dispatcher.lua b/libs/web/luasrc/dispatcher.lua
index 3805f5c9d..e3dc6370e 100644
--- a/libs/web/luasrc/dispatcher.lua
+++ b/libs/web/luasrc/dispatcher.lua
@@ -263,6 +263,13 @@ function createindex_plain(path, suffix)
 	if indexcache then
 		local cachedate = fs.mtime(indexcache)
 		if cachedate and cachedate > fs.mtime(path) then
+
+			assert(
+				sys.process.info("uid") == fs.stat(indexcache, "uid")
+				and fs.stat(indexcache, "mode") == "rw-------",
+				"Fatal: Indexcache is not sane!"
+			)
+
 			index = loadfile(indexcache)()
 			return index
 		end 		
@@ -287,6 +294,7 @@ function createindex_plain(path, suffix)
 	
 	if indexcache then
 		fs.writefile(indexcache, util.get_bytecode(index))
+		fs.chmod(indexcache, "a-rwx,u+rw")
 	end
 end
 
diff --git a/libs/web/luasrc/sauth.lua b/libs/web/luasrc/sauth.lua
index 7c483119c..0ac236753 100644
--- a/libs/web/luasrc/sauth.lua
+++ b/libs/web/luasrc/sauth.lua
@@ -57,7 +57,7 @@ end
 -- @param id	Session identifier
 -- @return		Session data
 function read(id)
-	if not id or not sane() then
+	if not id or not sane(sessionpath .. "/" .. id) then
 		return
 	end
 	clean()
@@ -67,9 +67,11 @@ end
 
 --- Check whether Session environment is sane.
 -- @return Boolean status
-function sane()
-	return luci.sys.process.info("uid") == luci.fs.stat(sessionpath, "uid")
-	 and luci.fs.stat(sessionpath, "mode") == "rwx------"
+function sane(file)
+	return luci.sys.process.info("uid")
+			== luci.fs.stat(file or sessionpath, "uid")
+		and luci.fs.stat(file or sessionpath, "mode")
+			== (file and "rw-------" or "rwx------")
 end
 
 
-- 
2.11.0