- Decorate.py Fixed bug 1507248 by ignoring header/footer characters

  outside the character set of the list's language.

- Utils.py  Fixed a security hole which allowed a crafted URI to inject
  bogus apparent messages into the error log, possibly inducing an admin to
  visit a phishing site.

2 files changed, 10 insertions, 4 deletions

diff --git a/Mailman/Handlers/Decorate.py b/Mailman/Handlers/Decorate.py
index 41db3950..d6b20391 100644
--- a/Mailman/Handlers/Decorate.py
+++ b/Mailman/Handlers/Decorate.py
@@ -95,8 +95,8 @@ def process(mlist, msg, msgdata):
         # TK: Try to keep the message plain by converting the header/
         # footer/oldpayload into unicode and encode with mcset/lcset.
         # Try to decode qp/base64 also.
-        uheader = unicode(header, lcset)
-        ufooter = unicode(footer, lcset)
+        uheader = unicode(header, lcset, 'ignore')
+        ufooter = unicode(footer, lcset, 'ignore')
         try:
             oldpayload = unicode(msg.get_payload(decode=True), mcset)
             frontsep = endsep = u''
diff --git a/Mailman/Utils.py b/Mailman/Utils.py
index d0eca99a..5218fed8 100644
--- a/Mailman/Utils.py
+++ b/Mailman/Utils.py
@@ -53,6 +53,7 @@ from Mailman import mm_cfg
 from Mailman import Errors
 from Mailman import Site
 from Mailman.SafeDict import SafeDict
+from Mailman.Logging.Syslog import syslog
 
 try:
     True, False
@@ -219,9 +220,16 @@ def ValidateEmail(s):
 
 
 
+# Patterns which may be used to form malicious path to inject a new
+# line in the mailman error log. (TK: advisory by Moritz Naumann)
+CRNLpat = re.compile(r'[^\x21-\x7e]')
+
 def GetPathPieces(envar='PATH_INFO'):
     path = os.environ.get(envar)
     if path:
+        if CRNLpat.search(path):
+            path = CRNLpat.split(path)[0]
+            syslog('error', 'Warning: Possible malformed path attack.')
         return [p for p in path.split('/') if p]
     return None
 
@@ -326,7 +334,6 @@ def Secure_MakeRandomPassword(length):
                         # We have no available source of cryptographically
                         # secure random characters.  Log an error and fallback
                         # to the user friendly passwords.
-                        from Mailman.Logging.Syslog import syslog
                         syslog('error',
                                'urandom not available, passwords not secure')
                         return UserFriendly_MakeRandomPassword(length)
@@ -541,7 +548,6 @@ def findtext(templatefile, dict=None, raw=False, lang=None, mlist=None):
                 text = sdict.interpolate(utemplate)
         except (TypeError, ValueError), e:
             # The template is really screwed up
-            from Mailman.Logging.Syslog import syslog
             syslog('error', 'broken template: %s\n%s', filename, e)
             pass
     if raw: