CVE-2021-4297: Insufficient Information (NVD-CWE-noinfo)
value: A vulnerability has been found in trampgeek jobe up to 1.6.4 and classified as problematic. This vulnerability affects the function runs_post of the file application/controllers/Restapi.php. The manipulation of the argument sourcefilename leads to an unknown weakness. Upgrading to version 1.6.5 is able to address this issue. The patch is identified as 694da5013dbecc8d30dd83e2a83e78faadf93771. It is recommended to upgrade the affected component. VDB-217174 is the identifier assigned to this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2023-01-01T19:15Z
Repository: https://github.com/trampgeek/jobe
Language: PHP
Files changed: README.md, application/controllers/Restapi.php
Commit date: 2021-01-31 11:33:53 +1300
Commit message: Prevent privilege escalation attacks via sourcefilename [issue #46](https://github.com/trampgeek/jobe/issues/46). Thanks Marlon.
Diff: diff --git a/README.md b/README.md
index 0a867ae..779c525 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,8 @@
 # JOBE
 
-Version: 1.6.4, 22 January 2021
+Version: 1.6.5, 31 January 2021
 
 
 Author: Richard Lobb, University of Canterbury, New Zealand
 
 Contributors: Tim Hunt, Fedor Lyanguzov, Kai-Cheung Leung
@@ -844,5 +844,10 @@ Thanks Tim Hunt for most of the work in this addition.
 
 ### 1.6.4 (22 January 2021)
 
   1. Workaround for bug in py_compile (https://bugs.python.org/issue38731)
 that results in multiple error messages when a python syntax check fails.
+
+### 1.6.5 (31 January 2021)
+
+  1. Prevent privilege escalation attacks via sourcefilename [issue #46](https://github.com/trampgeek/jobe/issues/46).
+  1. Add a load tester (ad hoc, experimental), loadtester.py.
diff --git a/application/controllers/Restapi.php b/application/controllers/Restapi.php
index 79a27d3..4851df9 100644
--- a/application/controllers/Restapi.php
+++ b/application/controllers/Restapi.php
@@ -147,14 +147,16 @@ class Restapi extends REST_Controller {
         // Check this looks like a valid request.
         if (!$run = $this->post('run_spec', false)) {
             $this->error('runs_post: missing or invalid run_spec parameter', 400);
         }
         if (!is_array($run) || !isset($run['sourcecode']) ||
-                !isset($run['language_id'])
-        ) {
+                !isset($run['language_id']) ) {
             $this->error('runs_post: invalid run specification', 400);
         }
+        if (isset($run->sourcefilename) && !self::is_valid_source_filename($run->sourcefilename)) {
+            $this->error('runs_post: invalid sourcefilename');
+        }
 
         // REST_Controller has called to_array on the JSON decoded
         // object, so we must first turn it back into an object.
         $run = (object) $run;
 
@@ -271,10 +273,28 @@ class Restapi extends REST_Controller {
     }
 
     // **********************
     // Support functions
     // **********************
+    
+    // Return true unless the given filename looks dangerous, e.g. has '/' or '..'
+    // substrings. Uses code from https://stackoverflow.com/questions/2021624/string-sanitizer-for-filename
+    private function is_valid_source_filename($filename) {
+        $sanitised = preg_replace(
+        '~
+        [<>:"/\\|?*]|            # file system reserved https://en.wikipedia.org/wiki/Filename#Reserved_characters_and_words
+        [\x00-\x1F]|             # control characters http://msdn.microsoft.com/en-us/library/windows/desktop/aa365247%28v=vs.85%29.aspx
+        [\x7F\xA0\xAD]|          # non-printing characters DEL, NO-BREAK SPACE, SOFT HYPHEN
+        [#\[\]@!$&\'()+,;=]|     # URI reserved https://tools.ietf.org/html/rfc3986#section-2.2
+        [{}^\~`]                 # URL unsafe characters https://www.ietf.org/rfc/rfc1738.txt
+        ~x',
+        '-', $filename);
+        // Avoid ".", ".." or ".hiddenFiles"
+        $sanitised = ltrim($sanitised, '.-');
+        return $sanitised === $filename;
+    }
+    
     private function is_valid_filespec($file) {
         return (count($file) == 2 || count($file) == 3) &&
              is_string($file[0]) &&
              is_string($file[1]) &&
              strlen($file[0]) >= MIN_FILE_IDENTIFIER_SIZE &&

Vulnerable code: Version: 1.6.4, 22 January 2021
                !isset($run['language_id'])
        ) {
Fixed code: Version: 1.6.5, 31 January 2021

### 1.6.5 (31 January 2021)

  1. Prevent privilege escalation attacks via sourcefilename [issue #46](https://github.com/trampgeek/jobe/issues/46).
  1. Add a load tester (ad hoc, experimental), loadtester.py.
                !isset($run['language_id']) ) {
        if (isset($run->sourcefilename) && !self::is_valid_source_filename($run->sourcefilename)) {
            $this->error('runs_post: invalid sourcefilename');
        }
    
    // Return true unless the given filename looks dangerous, e.g. has '/' or '..'
    // substrings. Uses code from https://stackoverflow.com/questions/2021624/string-sanitizer-for-filename
    private function is_valid_source_filename($filename) {
        $sanitised = preg_replace(
        '~
        [<>:"/\\|?*]|            # file system reserved https://en.wikipedia.org/wiki/Filename#Reserved_characters_and_words
        [\x00-\x1F]|             # control characters http://msdn.microsoft.com/en-us/library/windows/desktop/aa365247%28v=vs.85%29.aspx
        [\x7F\xA0\xAD]|          # non-printing characters DEL, NO-BREAK SPACE, SOFT HYPHEN
        [#\[\]@!$&\'()+,;=]|     # URI reserved https://tools.ietf.org/html/rfc3986#section-2.2
        [{}^\~`]                 # URL unsafe characters https://www.ietf.org/rfc/rfc1738.txt
        ~x',
        '-', $filename);
        // Avoid ".", ".." or ".hiddenFiles"
        $sanitised = ltrim($sanitised, '.-');
        return $sanitised === $filename;
    }