[sword-devel] API/Mod Config question

[Greg Hellings]

A flurry of AI assisted bug reports have come into Xiphos and BibleTime
over the past couple of months. Largely the BibleTime ones revolved around
perceived security threats for things like code injection and script
injections. One of these was a path traversal attack. BibleTime constructs
paths to the modules by taking the base path of the SwordMgr, module path,
and module name.

Ostensibly module paths and names could include path elements, leading to
projection of arbitrary files. This isn't really a concern, since it would
just display the contents of the file to the user. However, as most
displays are HTML based, if this was accompanied by exploiting a different
bug to allow exfiltration of content to a remote web endpoint, a user's
system could be compromised.

A mitigating factor for this is that we claim module path and module name
fit certain text patterns which disallow that. Namely, module names are
pretty limited to alphanumeric characters according to our documentation.
But scouring through the SWORD code that does not appear to actually be
anywhere enforced.

So the question is: is that statement validated in code anywhere? Can the
value of `getName` be trusted to only ever include alphanumeric characters?
And are module paths guaranteed, in code, to always resolve to a
sub-directory of the SwordMgr's directory? If not, then it is incumbent
upon the applications to make that guarantee to ensure file safety.

--Greg
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://crosswire.org/pipermail/sword-devel/attachments/20260809/412fbfc3/attachment.htm>