openkylin
/
kylin-system-updater
mirror of https://gitee.com/openkylin/kylin-system-updater.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

命令注入漏洞:去除安装snap接口...

This commit is contained in:
Xueyi Luo 2022-04-15 11:39:03 +08:00
parent 60692ed11a
commit e8a1f38cd3
1 changed files with 31 additions and 67 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

98
backend/SystemUpdater/UpdateManagerDbus.py
View File

@ -618,42 +618,6 @@ class UpdateManagerDbusController(dbus.service.Object):
except Exception as e: except Exception as e:
logging.error(str(e)) logging.error(str(e))
# dbus接口：安装本地snap包
@dbus.service.method(UPDATER_DBUS_INTERFACE, in_signature='s', out_signature='b', sender_keyword='sender')
def InstallSnap(self, path, sender=None):
logging.info(COLORMETHOR_PREFIX+'method'+COLORLOG_SUFFIX+" Install Snap Packages(%s)...",path)
try:
status= subprocess.getstatusoutput("snap install " +path+" --dangerous")
except Exception as e:
logging.error("Install Snap Packages occur error:%s",str(e))
msg = {"statue": "Fail", "errorcode": str(0), "error_message": _("Command execution error")}
kwarg = {"error_message": str(msg)}
self.KumSnapSignal("snap_error", kwarg)
return False
#安装成功
if status[0]==0:
logging.info("Install Snap Packages(%s) is success",path)
msg = {"statue": "Success", "errorcode": str(0), "error_message": ""}
kwarg = {"action": str(msg)}
self.KumSnapSignal("snap_finish", kwarg)
return True
else:
#失败之后的处理
logging.info("Install Snap Packages(%s) is Failed",path)
if "supported architectures" in status[1]:
logging.error("Supported architectures does not match")
msg = {"statue": "Fail", "errorcode": str(0), "error_message": _("Unsupported architecture")}
else:
logging.error("Other Error...")
msg = {"statue": "Fail", "errorcode": str(0), "error_message": _("Other Error")}
kwarg = {"error_message": str(msg)}
self.KumSnapSignal("snap_error", kwarg)
return False
## dbus接口: 开启或关闭预下载功能 ## dbus接口: 开启或关闭预下载功能
@dbus.service.method(UPDATER_DBUS_INTERFACE, in_signature='b', out_signature='b') @dbus.service.method(UPDATER_DBUS_INTERFACE, in_signature='b', out_signature='b')
def SetPreDownloadState(self, _state): def SetPreDownloadState(self, _state):
@ -747,41 +711,41 @@ class UpdateManagerDbusController(dbus.service.Object):
logging.error(str(e)) logging.error(str(e))
return propertyValue return propertyValue
# dbus接口：安装本地snap包 # # dbus接口：安装本地snap包
@dbus.service.method(UPDATER_DBUS_INTERFACE, in_signature='s', out_signature='b', sender_keyword='sender') # @dbus.service.method(UPDATER_DBUS_INTERFACE, in_signature='s', out_signature='b', sender_keyword='sender')
def InstallSnap(self, path, sender=None): # def InstallSnap(self, path, sender=None):
logging.info(COLORMETHOR_PREFIX+'Method'+COLORLOG_SUFFIX+" Install Snap Packages(%s)...",path) # logging.info(COLORMETHOR_PREFIX+'Method'+COLORLOG_SUFFIX+" Install Snap Packages(%s)...",path)
try: # try:
status= subprocess.getstatusoutput("snap install " +path+" --dangerous") # status= subprocess.getstatusoutput("snap install " +path+" --dangerous")
except Exception as e: # except Exception as e:
logging.error("Install Snap Packages occur error:%s",str(e)) # logging.error("Install Snap Packages occur error:%s",str(e))
msg = {"statue": "Fail", "errorcode": str(0), "error_message": _("Command execution error")} # msg = {"statue": "Fail", "errorcode": str(0), "error_message": _("Command execution error")}
kwarg = {"error_message": str(msg)} # kwarg = {"error_message": str(msg)}
self.KumSnapSignal("snap_error", kwarg) # self.KumSnapSignal("snap_error", kwarg)
return False # return False
#安装成功 # #安装成功
if status[0]==0: # if status[0]==0:
logging.info("Install Snap Packages(%s) is success",path) # logging.info("Install Snap Packages(%s) is success",path)
msg = {"statue": "Success", "errorcode": str(0), "error_message": ""} # msg = {"statue": "Success", "errorcode": str(0), "error_message": ""}
kwarg = {"action": str(msg)} # kwarg = {"action": str(msg)}
self.KumSnapSignal("snap_finish", kwarg) # self.KumSnapSignal("snap_finish", kwarg)
return True # return True
else: # else:
#失败之后的处理 # #失败之后的处理
logging.info("Install Snap Packages(%s) is Failed",path) # logging.info("Install Snap Packages(%s) is Failed",path)
if "supported architectures" in status[1]: # if "supported architectures" in status[1]:
logging.error("Supported architectures does not match") # logging.error("Supported architectures does not match")
msg = {"statue": "Fail", "errorcode": str(0), "error_message": _("Unsupported architecture")} # msg = {"statue": "Fail", "errorcode": str(0), "error_message": _("Unsupported architecture")}
else: # else:
logging.error("Other Error...") # logging.error("Other Error...")
msg = {"statue": "Fail", "errorcode": str(0), "error_message": _("Other Error")} # msg = {"statue": "Fail", "errorcode": str(0), "error_message": _("Other Error")}
kwarg = {"error_message": str(msg)} # kwarg = {"error_message": str(msg)}
self.KumSnapSignal("snap_error", kwarg) # self.KumSnapSignal("snap_error", kwarg)
return False # return False
# 监控是否需要重启的操作 # 监控是否需要重启的操作
@dbus.service.method(UPDATER_DBUS_INTERFACE, in_signature='s', out_signature='b') @dbus.service.method(UPDATER_DBUS_INTERFACE, in_signature='s', out_signature='b')