From f3ad75691aea30d2d68aab19fbfa9031409c39d7 Mon Sep 17 00:00:00 2001 From: red-001 Date: Fri, 30 Jun 2017 19:14:39 +0100 Subject: Create a filesystem abstraction layer for CSM and only allow accessing files that are scanned into it. (#5965) * Load client-side mods into memory before executing them. This removes the remaining filesystem access that client-sided mods had and it will hopefully make then more secure. * Lua Virtual filesystem: don't load the files into memory just scan the filenames into memory. * Fix the issues with backtrace * fix most of the issues * fix code style. * add a comment --- src/script/common/c_internal.cpp | 34 ++----------- src/script/common/c_internal.h | 4 +- src/script/cpp_api/s_base.cpp | 35 ++++++++++++- src/script/cpp_api/s_base.h | 13 +++++ src/script/cpp_api/s_security.cpp | 103 ++++++++++++++++++++++++++------------ src/script/cpp_api/s_security.h | 8 ++- src/script/lua_api/l_client.cpp | 9 ++++ src/script/lua_api/l_client.h | 3 ++ src/script/lua_api/l_util.cpp | 4 +- src/script/scripting_client.cpp | 4 ++ src/script/scripting_mainmenu.cpp | 1 + src/script/scripting_server.cpp | 1 + 12 files changed, 146 insertions(+), 73 deletions(-) (limited to 'src/script') diff --git a/src/script/common/c_internal.cpp b/src/script/common/c_internal.cpp index b349f9dd1..0b388e383 100644 --- a/src/script/common/c_internal.cpp +++ b/src/script/common/c_internal.cpp @@ -24,37 +24,9 @@ with this program; if not, write to the Free Software Foundation, Inc., std::string script_get_backtrace(lua_State *L) { - std::string s; - lua_getglobal(L, "debug"); - if(lua_istable(L, -1)){ - lua_getfield(L, -1, "traceback"); - if(lua_isfunction(L, -1)) { - lua_call(L, 0, 1); - if(lua_isstring(L, -1)){ - s = lua_tostring(L, -1); - } - } - lua_pop(L, 1); - } - lua_pop(L, 1); - return s; -} - -int script_error_handler(lua_State *L) { - lua_getglobal(L, "debug"); - if (!lua_istable(L, -1)) { - lua_pop(L, 1); - return 1; - } - lua_getfield(L, -1, "traceback"); - if (!lua_isfunction(L, -1)) { - lua_pop(L, 2); - return 1; - } - lua_pushvalue(L, 1); - lua_pushinteger(L, 2); - lua_call(L, 2, 1); - return 1; + lua_rawgeti(L, LUA_REGISTRYINDEX, CUSTOM_RIDX_BACKTRACE); + lua_call(L, 0, 1); + return luaL_checkstring(L, -1); } int script_exception_wrapper(lua_State *L, lua_CFunction f) diff --git a/src/script/common/c_internal.h b/src/script/common/c_internal.h index fc59b0e2e..b77f0a7c3 100644 --- a/src/script/common/c_internal.h +++ b/src/script/common/c_internal.h @@ -53,11 +53,11 @@ extern "C" { #define CUSTOM_RIDX_SCRIPTAPI (CUSTOM_RIDX_BASE) #define CUSTOM_RIDX_GLOBALS_BACKUP (CUSTOM_RIDX_BASE + 1) #define CUSTOM_RIDX_CURRENT_MOD_NAME (CUSTOM_RIDX_BASE + 2) -#define CUSTOM_RIDX_ERROR_HANDLER (CUSTOM_RIDX_BASE + 3) +#define CUSTOM_RIDX_BACKTRACE (CUSTOM_RIDX_BASE + 3) // Pushes the error handler onto the stack and returns its index #define PUSH_ERROR_HANDLER(L) \ - (lua_rawgeti((L), LUA_REGISTRYINDEX, CUSTOM_RIDX_ERROR_HANDLER), lua_gettop((L))) + (lua_rawgeti((L), LUA_REGISTRYINDEX, CUSTOM_RIDX_BACKTRACE), lua_gettop((L))) #define PCALL_RESL(L, RES) do { \ int result_ = (RES); \ diff --git a/src/script/cpp_api/s_base.cpp b/src/script/cpp_api/s_base.cpp index aaf26a9c3..6bea8230b 100644 --- a/src/script/cpp_api/s_base.cpp +++ b/src/script/cpp_api/s_base.cpp @@ -89,8 +89,10 @@ ScriptApiBase::ScriptApiBase() lua_rawseti(m_luastack, LUA_REGISTRYINDEX, CUSTOM_RIDX_SCRIPTAPI); // Add and save an error handler - lua_pushcfunction(m_luastack, script_error_handler); - lua_rawseti(m_luastack, LUA_REGISTRYINDEX, CUSTOM_RIDX_ERROR_HANDLER); + lua_getglobal(m_luastack, "debug"); + lua_getfield(m_luastack, -1, "traceback"); + lua_rawseti(m_luastack, LUA_REGISTRYINDEX, CUSTOM_RIDX_BACKTRACE); + lua_pop(m_luastack, 1); // pop debug // If we are using LuaJIT add a C++ wrapper function to catch // exceptions thrown in Lua -> C++ calls @@ -158,6 +160,35 @@ void ScriptApiBase::loadScript(const std::string &script_path) lua_pop(L, 1); // Pop error handler } +#ifndef SERVER +void ScriptApiBase::loadModFromMemory(const std::string &mod_name) +{ + ModNameStorer mod_name_storer(getStack(), mod_name); + + const std::string *init_filename = getClient()->getModFile(mod_name + ":init.lua"); + const std::string display_filename = mod_name + ":init.lua"; + if(init_filename == NULL) + throw ModError("Mod:\"" + mod_name + "\" lacks init.lua"); + + verbosestream << "Loading and running script " << display_filename << std::endl; + + lua_State *L = getStack(); + + int error_handler = PUSH_ERROR_HANDLER(L); + + bool ok = ScriptApiSecurity::safeLoadFile(L, init_filename->c_str(), display_filename.c_str()); + if (ok) + ok = !lua_pcall(L, 0, 0, error_handler); + if (!ok) { + std::string error_msg = luaL_checkstring(L, -1); + lua_pop(L, 2); // Pop error message and error handler + throw ModError("Failed to load and run mod \"" + + mod_name + "\":\n" + error_msg); + } + lua_pop(L, 1); // Pop error handler +} +#endif + // Push the list of callbacks (a lua table). // Then push nargs arguments. // Then call this function, which diff --git a/src/script/cpp_api/s_base.h b/src/script/cpp_api/s_base.h index 38ee9901b..28fefdd37 100644 --- a/src/script/cpp_api/s_base.h +++ b/src/script/cpp_api/s_base.h @@ -54,6 +54,12 @@ extern "C" { #define setOriginFromTable(index) \ setOriginFromTableRaw(index, __FUNCTION__) +enum class ScriptingType: u8 { + Client, + Server, + MainMenu +}; + class Server; #ifndef SERVER class Client; @@ -73,6 +79,10 @@ public: void loadMod(const std::string &script_path, const std::string &mod_name); void loadScript(const std::string &script_path); +#ifndef SERVER + void loadModFromMemory(const std::string &mod_name); +#endif + void runCallbacksRaw(int nargs, RunCallbacksMode mode, const char *fxn); @@ -82,6 +92,8 @@ public: IGameDef *getGameDef() { return m_gamedef; } Server* getServer(); + void setType(ScriptingType type) { m_type = type; } + ScriptingType getType() { return m_type; } #ifndef SERVER Client* getClient(); #endif @@ -133,6 +145,7 @@ private: IGameDef *m_gamedef = nullptr; Environment *m_environment = nullptr; GUIEngine *m_guiengine = nullptr; + ScriptingType m_type; }; #endif /* S_BASE_H_ */ diff --git a/src/script/cpp_api/s_security.cpp b/src/script/cpp_api/s_security.cpp index 5ad7947d5..761597701 100644 --- a/src/script/cpp_api/s_security.cpp +++ b/src/script/cpp_api/s_security.cpp @@ -22,6 +22,7 @@ with this program; if not, write to the Free Software Foundation, Inc., #include "filesys.h" #include "porting.h" #include "server.h" +#include "client.h" #include "settings.h" #include @@ -140,8 +141,18 @@ void ScriptApiSecurity::initializeSecurity() lua_State *L = getStack(); + // Backup globals to the registry + lua_getglobal(L, "_G"); + lua_rawseti(L, LUA_REGISTRYINDEX, CUSTOM_RIDX_GLOBALS_BACKUP); - int old_globals = backupGlobals(L); + // Replace the global environment with an empty one + int thread = getThread(L); + createEmptyEnv(L); + setLuaEnv(L, thread); + + // Get old globals + lua_rawgeti(L, LUA_REGISTRYINDEX, CUSTOM_RIDX_GLOBALS_BACKUP); + int old_globals = lua_gettop(L); // Copy safe base functions @@ -274,80 +285,83 @@ void ScriptApiSecurity::initializeSecurityClient() m_secure = true; lua_State *L = getStack(); + int thread = getThread(L); - - int old_globals = backupGlobals(L); - + // create an empty environment + createEmptyEnv(L); // Copy safe base functions lua_getglobal(L, "_G"); + lua_getfield(L, -2, "_G"); copy_safe(L, whitelist, sizeof(whitelist)); // And replace unsafe ones SECURE_API(g, dofile); + SECURE_API(g, load); + SECURE_API(g, loadfile); SECURE_API(g, loadstring); SECURE_API(g, require); - lua_pop(L, 1); + lua_pop(L, 2); // Copy safe OS functions - lua_getfield(L, old_globals, "os"); + lua_getglobal(L, "os"); lua_newtable(L); copy_safe(L, os_whitelist, sizeof(os_whitelist)); - lua_setglobal(L, "os"); + lua_setfield(L, -3, "os"); lua_pop(L, 1); // Pop old OS // Copy safe debug functions - lua_getfield(L, old_globals, "debug"); + lua_getglobal(L, "debug"); lua_newtable(L); copy_safe(L, debug_whitelist, sizeof(debug_whitelist)); - lua_setglobal(L, "debug"); + lua_setfield(L, -3, "debug"); lua_pop(L, 1); // Pop old debug #if USE_LUAJIT // Copy safe jit functions, if they exist - lua_getfield(L, -1, "jit"); - if (!lua_isnil(L, -1)) { - lua_newtable(L); - copy_safe(L, jit_whitelist, sizeof(jit_whitelist)); - lua_setglobal(L, "jit"); - } + lua_getglobal(L, "jit"); + lua_newtable(L); + copy_safe(L, jit_whitelist, sizeof(jit_whitelist)); + lua_setfield(L, -3, "jit"); lua_pop(L, 1); // Pop old jit #endif - lua_pop(L, 1); // Pop globals_backup + // Set the environment to the one we created earlier + setLuaEnv(L, thread); } -int ScriptApiSecurity::backupGlobals(lua_State *L) +int ScriptApiSecurity::getThread(lua_State *L) { - // Backup globals to the registry - lua_getglobal(L, "_G"); - lua_rawseti(L, LUA_REGISTRYINDEX, CUSTOM_RIDX_GLOBALS_BACKUP); - - // Replace the global environment with an empty one #if LUA_VERSION_NUM <= 501 int is_main = lua_pushthread(L); // Push the main thread FATAL_ERROR_IF(!is_main, "Security: ScriptApi's Lua state " "isn't the main Lua thread!"); + return lua_gettop(L); #endif + return 0; +} + +void ScriptApiSecurity::createEmptyEnv(lua_State *L) +{ lua_newtable(L); // Create new environment lua_pushvalue(L, -1); - lua_setfield(L, -2, "_G"); // Set _G of new environment + lua_setfield(L, -2, "_G"); // Create the _G loop +} + +void ScriptApiSecurity::setLuaEnv(lua_State *L, int thread) +{ #if LUA_VERSION_NUM >= 502 // Lua >= 5.2 // Set the global environment lua_rawseti(L, LUA_REGISTRYINDEX, LUA_RIDX_GLOBALS); #else // Lua <= 5.1 // Set the environment of the main thread - FATAL_ERROR_IF(!lua_setfenv(L, -2), "Security: Unable to set " + FATAL_ERROR_IF(!lua_setfenv(L, thread), "Security: Unable to set " "environment of the main Lua thread!"); lua_pop(L, 1); // Pop thread #endif - - // Get old globals - lua_rawgeti(L, LUA_REGISTRYINDEX, CUSTOM_RIDX_GLOBALS_BACKUP); - return lua_gettop(L); } bool ScriptApiSecurity::isSecure(lua_State *L) @@ -367,11 +381,13 @@ bool ScriptApiSecurity::isSecure(lua_State *L) } -bool ScriptApiSecurity::safeLoadFile(lua_State *L, const char *path) +bool ScriptApiSecurity::safeLoadFile(lua_State *L, const char *path, const char *display_name) { FILE *fp; char *chunk_name; - if (path == NULL) { + if (!display_name) + display_name = path; + if (!path) { fp = stdin; chunk_name = const_cast("=stdin"); } else { @@ -380,10 +396,10 @@ bool ScriptApiSecurity::safeLoadFile(lua_State *L, const char *path) lua_pushfstring(L, "%s: %s", path, strerror(errno)); return false; } - chunk_name = new char[strlen(path) + 2]; + chunk_name = new char[strlen(display_name) + 2]; chunk_name[0] = '@'; chunk_name[1] = '\0'; - strcat(chunk_name, path); + strcat(chunk_name, display_name); } size_t start = 0; @@ -626,8 +642,29 @@ int ScriptApiSecurity::sl_g_load(lua_State *L) int ScriptApiSecurity::sl_g_loadfile(lua_State *L) { - const char *path = NULL; +#ifndef SERVER + lua_rawgeti(L, LUA_REGISTRYINDEX, CUSTOM_RIDX_SCRIPTAPI); + ScriptApiBase *script = (ScriptApiBase *) lua_touserdata(L, -1); + lua_pop(L, 1); + if (script->getType() == ScriptingType::Client) { + std:: string display_path = lua_tostring(L, 1); + const std::string *path = script->getClient()->getModFile(display_path); + if (!path) { + std::string error_msg = "Coudln't find script called:" + display_path; + lua_pushnil(L); + lua_pushstring(L, error_msg.c_str()); + return 2; + } + if (!safeLoadFile(L, path->c_str(), display_path.c_str())) { + lua_pushnil(L); + lua_insert(L, -2); + return 2; + } + return 1; + } +#endif + const char *path = NULL; if (lua_isstring(L, 1)) { path = lua_tostring(L, 1); CHECK_SECURE_PATH_INTERNAL(L, path, false, NULL); diff --git a/src/script/cpp_api/s_security.h b/src/script/cpp_api/s_security.h index f0eef00bb..059dccef1 100644 --- a/src/script/cpp_api/s_security.h +++ b/src/script/cpp_api/s_security.h @@ -41,14 +41,18 @@ with this program; if not, write to the Free Software Foundation, Inc., class ScriptApiSecurity : virtual public ScriptApiBase { public: - int backupGlobals(lua_State *L); + int getThread(lua_State *L); + // creates an empty Lua environment + void createEmptyEnv(lua_State *L); + // sets the enviroment to the table thats on top of the stack + void setLuaEnv(lua_State *L, int thread); // Sets up security on the ScriptApi's Lua state void initializeSecurity(); void initializeSecurityClient(); // Checks if the Lua state has been secured static bool isSecure(lua_State *L); // Loads a file as Lua code safely (doesn't allow bytecode). - static bool safeLoadFile(lua_State *L, const char *path); + static bool safeLoadFile(lua_State *L, const char *path, const char *display_name = NULL); // Checks if mods are allowed to read (and optionally write) to the path static bool checkPath(lua_State *L, const char *path, bool write_required, bool *write_allowed=NULL); diff --git a/src/script/lua_api/l_client.cpp b/src/script/lua_api/l_client.cpp index 84eafd3f0..1077d5f2d 100644 --- a/src/script/lua_api/l_client.cpp +++ b/src/script/lua_api/l_client.cpp @@ -341,6 +341,14 @@ int ModApiClient::l_get_privilege_list(lua_State *L) } return 1; } + +// get_builtin_path() +int ModApiClient::l_get_builtin_path(lua_State *L) +{ + lua_pushstring(L, BUILTIN_MOD_NAME ":"); + return 1; +} + void ModApiClient::Initialize(lua_State *L, int top) { API_FCT(get_current_modname); @@ -366,4 +374,5 @@ void ModApiClient::Initialize(lua_State *L, int top) API_FCT(get_node_def); API_FCT(take_screenshot); API_FCT(get_privilege_list); + API_FCT(get_builtin_path); } diff --git a/src/script/lua_api/l_client.h b/src/script/lua_api/l_client.h index 2f0c2e3f8..7472915f5 100644 --- a/src/script/lua_api/l_client.h +++ b/src/script/lua_api/l_client.h @@ -95,6 +95,9 @@ private: // get_privilege_list() static int l_get_privilege_list(lua_State *L); + // get_builtin_path() + static int l_get_builtin_path(lua_State *L); + public: static void Initialize(lua_State *L, int top); }; diff --git a/src/script/lua_api/l_util.cpp b/src/script/lua_api/l_util.cpp index 3cf19f024..c68f64a64 100644 --- a/src/script/lua_api/l_util.cpp +++ b/src/script/lua_api/l_util.cpp @@ -246,7 +246,7 @@ int ModApiUtil::l_get_builtin_path(lua_State *L) { NO_MAP_LOCK_REQUIRED; - std::string path = porting::path_share + DIR_DELIM + "builtin"; + std::string path = porting::path_share + DIR_DELIM + "builtin" + DIR_DELIM; lua_pushstring(L, path.c_str()); return 1; @@ -470,8 +470,6 @@ void ModApiUtil::InitializeClient(lua_State *L, int top) API_FCT(is_yes); - API_FCT(get_builtin_path); - API_FCT(compress); API_FCT(decompress); diff --git a/src/script/scripting_client.cpp b/src/script/scripting_client.cpp index da289e564..904f735f3 100644 --- a/src/script/scripting_client.cpp +++ b/src/script/scripting_client.cpp @@ -36,6 +36,7 @@ ClientScripting::ClientScripting(Client *client): ScriptApiBase() { setGameDef(client); + setType(ScriptingType::Client); SCRIPTAPI_PRECHECKHEADER @@ -58,6 +59,9 @@ ClientScripting::ClientScripting(Client *client): lua_pushstring(L, "client"); lua_setglobal(L, "INIT"); + lua_pushstring(L, "/"); + lua_setglobal(L, "DIR_DELIM"); + infostream << "SCRIPTAPI: Initialized client game modules" << std::endl; } diff --git a/src/script/scripting_mainmenu.cpp b/src/script/scripting_mainmenu.cpp index 48957b472..e2f735927 100644 --- a/src/script/scripting_mainmenu.cpp +++ b/src/script/scripting_mainmenu.cpp @@ -36,6 +36,7 @@ extern "C" { MainMenuScripting::MainMenuScripting(GUIEngine* guiengine) { setGuiEngine(guiengine); + setType(ScriptingType::MainMenu); SCRIPTAPI_PRECHECKHEADER diff --git a/src/script/scripting_server.cpp b/src/script/scripting_server.cpp index cd01b0773..51e13f04d 100644 --- a/src/script/scripting_server.cpp +++ b/src/script/scripting_server.cpp @@ -50,6 +50,7 @@ extern "C" { ServerScripting::ServerScripting(Server* server) { setGameDef(server); + setType(ScriptingType::Server); // setEnv(env) is called by ScriptApiEnv::initializeEnvironment() // once the environment has been created -- cgit v1.2.3