Subject: restrictBox bug?

From: Dave Halsema <[email-masked]>
Date: Fri, 10 Jan 2003 14:56:52 -0500 (EST)

I believe I may have found a bug in mailboxfile() when the restrictBox
option is enabled in the imap-2002[ab] distribution.

With restrictBox active, it is not possible to select mailboxes when
the name contain two periods, such as:

	mail/foo..bar
	mail/foo...bar

It looks like the check to keep people in their home directory may
be a bit overzealous.  If I am correct, then the conditions which
would allow people to "escape" out of their home directory are:

	- If the mailbox name begins with "../"
	- If the mailbox name ends with "/.."	(necessary?, pointless?)
	- If the mailbox name contains "/../"

Given these assumptions, I've modified the start of mailboxfile()
for a possible patch, but I will defer to Mark Crispin to confirm
that this is indeed a bug, and the best/correct way to fix it.

BEFORE
--------------------
/* Return mailbox file name
 * Accepts: destination buffer
 *          mailbox name
 * Returns: file name or empty string for driver-selected INBOX or NIL if error
 */

char *mailboxfile (char *dst,char *name)
{
  struct passwd *pw;
  char *s;
  if (!name || !*name || (*name == '{') || (strlen (name) > NETMAXMBX) ||
      ((anonymous || blackBox || restrictBox || (*name == '#')) &&
       (strstr (name,"..") || strstr (name,"//") || strstr (name,"/~"))))
    dst = NIL;                  /* invalid name */

AFTER
--------------------
/* Return mailbox file name
 * Accepts: destination buffer
 *          mailbox name
 * Returns: file name or empty string for driver-selected INBOX or NIL if error
 */

char *mailboxfile (char *dst,char *name)
{
  struct passwd *pw;
  char *s;
  if (!name || !*name || (*name == '{') || (strlen (name) > NETMAXMBX) ||
      ((anonymous || blackBox || restrictBox || (*name == '#')) &&
        (strstr (name,"/../") || (strncmp(name, "../", 3) == 0) ||
        (strncmp((name + strlen(name) - 3), "/..", 3) == 0) ||
         strstr (name,"//") || strstr (name,"/~"))))
    dst = NIL;                  /* invalid name */

I don't know how hard it would be to implement, but it might be
nice if mailbox names starting with the following were valid with
restrictBox enabled.

	~<username>/
	<homedir>/

Example:  If my username is halsema, then the following could be
selectable mailbox names.

	~halsema/foobar
	~halsema/mail/foobar
	/home/halsema/foobar
	/home/halsema/mail/foobar

Thanks!

    -Dave
-- 
David A. Halsema
Purdue University
IT Computing Services
[email-masked]
-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Fri, 10 Jan 2003 12:03:35 -0800 (PST)

It is intentional that all names with ".." in them are prohibited under
restrictBox conditions.  This restriction is, as you noted, a bit excessive
for pure UNIX systems.  But this code, even in a UNIX-only port, does not only
run on pure UNIX systems; there's Cygwin as a current example.  Your patch is
safe on Cygwin, but will it always be?

I've taken the position of "better to be safe than sorry."  It's easier to
have (and explain) an absolute prohibition on ".." than to have an ever more
complex determination of what is "safe" and what is "unsafe".

Of course, you can always apply your patch for your site, and it's probably
fine for you.  That's why I provide sources, and that is why env_unix.c is
specifically identified as a source code module that people may want to patch
(and why that routine is in that file).

> nice if mailbox names starting with the following were valid with

That's already there, although it depends upon how you set restrictBox.  It
won't work if you set RESTRICTOTHERUSER in restrictBox.

---

From: Dave Halsema <[email-masked]>
Date: Thu, 30 Jan 2003 22:26:32 -0500 (EST)

> Date: Fri, 10 Jan 2003 12:03:35 -0800 (PST)
> From: Mark Crispin <[email-masked]>
> To: Dave Halsema <[email-masked]>
> Cc: [email-masked]
> Subject: re: restrictBox bug?
>

Mark,

Perhaps a bit late, but I just wanted to say thanks for taking the time
to share your thoughts behind the ".." prohibition when restrictBox
is enabled.

Before imap-2002, we had been applying our own patch to get this
feature.  After seeing how many people were negatively affected (very
low), we decided to work with the users to rename their mailboxes
and stick with the standard distribution, which makes it a bit easier
for us to maintain.

For those interested in numbers, we had 33 people out of 45,000+ with
36 mailboxes containing a sequence of two or more dots.  Of those,
many had the exact same mailbox name!

	Misc...

Thanks again.

    -Dave