huntedbytheirs/kappa
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: fetcher security — fork+execve, hash verification, tar safety, CLI --help

Browse Source 
B1: Replaced all std::system()/popen() with fork+execve — zero shell injection
B2+B3: Added sha256/sha512/md5 fields to PackageDef, parser support, actual hash comparison in verify_hash()
B4: tar --no-same-owner --no-same-permissions, zip uses unzip instead of tar
B5: Patch sha256 verified before application via -i flag (no shell redirect)
B6: kappa fetch --help now prints usage and exits 0
Also: removed dead ternary code, added <cstdlib>/<sys/wait.h>/<unistd.h>
This commit is contained in:
huntedbytheirs
2026-07-30 03:59:15 -04:00
parent 72e582eb15
commit d7fc9d45fb
6 changed files with 250 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/fetch/fetch.cpp
+199
View File
@@ -0,0 +1,199 @@
#include "kappa/fetch/fetch.hpp"
#include "kappa/paths.hpp"
#include <array>
#include <cstdio>
#include <cstdlib>
#include <filesystem>
#include <format>
#include <string>
#include <sys/wait.h>
#include <unistd.h>
#include <vector>
namespace kappa::fetch {
namespace fs = std::filesystem;
using namespace std::string_view_literals;
static int exec_cmd(const std::vector<std::string>& argv) {
if (argv.empty()) { return -1; }
std::vector<char*> cargs;
for (auto& a : argv) { cargs.push_back(const_cast<char*>(a.c_str())); }
cargs.push_back(nullptr);
pid_t pid = fork();
if (pid == 0) {
execvp(cargs[0], cargs.data());
_exit(127);
}
if (pid < 0) { return -1; }
int status = 0;
waitpid(pid, &status, 0);
return WIFEXITED(status) ? WEXITSTATUS(status) : -1;
}
static std::string exec_capture(const std::vector<std::string>& argv) {
int pipefd[2];
if (pipe(pipefd) != 0) { return ""; }
pid_t pid = fork();
if (pid == 0) {
close(pipefd[0]);
dup2(pipefd[1], STDOUT_FILENO);
close(pipefd[1]);
std::vector<char*> cargs;
for (auto& a : argv) { cargs.push_back(const_cast<char*>(a.c_str())); }
cargs.push_back(nullptr);
execvp(cargs[0], cargs.data());
_exit(127);
}
if (pid < 0) { close(pipefd[0]); close(pipefd[1]); return ""; }
close(pipefd[1]);
std::array<char, 256> buf;
std::string result;
ssize_t n;
while ((n = read(pipefd[0], buf.data(), buf.size() - 1)) > 0) {
buf[static_cast<std::size_t>(n)] = '\0';
result += buf.data();
}
close(pipefd[0]);
waitpid(pid, nullptr, 0);
if (!result.empty() && result.back() == '\n') { result.pop_back(); }
return result;
}
static std::string interpret_url(const dsl::PackageDef& pkg) {
auto url = pkg.source;
for (auto& [from, to] : {
std::pair{"${name}"sv, std::string_view(pkg.name)},
std::pair{"${version}"sv, std::string_view(pkg.version)}}) {
std::size_t pos = 0;
while ((pos = url.find(from, pos)) != std::string::npos) {
url.replace(pos, from.size(), to);
pos += to.size();
}
}
return url;
}
static bool verify_hash(const fs::path& file, std::string_view algo,
std::string_view expected) {
if (expected.empty()) { return true; }
std::string tool;
if (algo == "sha256") { tool = "sha256sum"; }
else if (algo == "sha512") { tool = "sha512sum"; }
else if (algo == "md5") { tool = "md5sum"; }
else { return false; }
auto output = exec_capture({tool, file.string()});
if (output.empty()) { return false; }
auto space = output.find(' ');
auto computed = (space != std::string::npos)
? output.substr(0, space)
: output;
return computed == expected;
}
FetchResult fetch(const dsl::PackageDef& pkg) {
FetchResult result;
auto url = interpret_url(pkg);
if (url.empty()) {
result.error = "empty source URL";
return result;
}
auto ext_pos = url.rfind('.');
auto ext = (ext_pos != std::string::npos)
? url.substr(ext_pos + 1)
: std::string{};
if (ext == "gz" || ext == "xz" || ext == "zst") {
auto prev = url.rfind('.', ext_pos - 1);
if (prev != std::string::npos) {
std::string compound{url.substr(prev + 1,
ext_pos - prev - 1)};
ext = compound + "." + ext;
}
}
auto dest_name = pkg.name + "-" + pkg.version;
auto dest_file = fs::path(paths::temp_dir) / (dest_name + "." + ext);
result.work_dir = fs::path(paths::temp_dir) / dest_name;
if (ext == "git") {
int rc = exec_cmd({"git", "clone", url, result.work_dir.string()});
if (rc != 0) { result.error = "git clone failed"; return result; }
} else {
fs::create_directories(paths::temp_dir);
int rc = exec_cmd({"curl", "-L", "-o", dest_file.string(), url});
if (rc != 0) { result.error = "download failed"; return result; }
bool verified = false;
for (auto algo : {"sha512", "sha256", "md5"}) {
std::string_view expected;
if (std::string_view(algo) == "sha512") { expected = pkg.sha512; }
else if (std::string_view(algo) == "sha256") { expected = pkg.sha256; }
else { expected = pkg.md5; }
if (!expected.empty()) {
if (verify_hash(dest_file, algo, expected)) {
verified = true;
} else {
result.error = std::format("{} mismatch", algo);
return result;
}
}
}
if (!verified && !pkg.sha256.empty()) {
result.error = "hash verification failed";
return result;
}
auto extract_cmd = std::string{"tar"};
if (ext == "zip") {
int rc2 = exec_cmd({"unzip", "-o", dest_file.string(),
"-d", result.work_dir.string()});
if (rc2 != 0) { result.error = "extraction failed"; return result; }
} else {
int rc2 = exec_cmd({"tar", "xf", dest_file.string(),
"-C", paths::temp_dir.string(),
"--no-same-owner", "--no-same-permissions"});
if (rc2 != 0) { result.error = "extraction failed"; return result; }
}
fs::remove(dest_file);
}
for (auto& patch : pkg.patches) {
auto patch_path = patch.url;
auto patch_file = patch_path;
if (patch_path.starts_with("http")) {
auto local = fs::path(paths::temp_dir)
/ fs::path(patch_path).filename();
int rc = exec_cmd({"curl", "-L", "-o", local.string(),
patch_path});
if (rc != 0) { continue; }
patch_file = local.string();
}
if (!patch.sha256.empty()) {
if (!verify_hash(patch_file, "sha256", patch.sha256)) {
result.error = "patch hash mismatch: " + patch.url;
return result;
}
}
exec_cmd({"patch", "-p" + std::to_string(patch.level),
"-d", result.work_dir.string(), "-i", patch_file});
}
return result;
}
} // namespace kappa::fetch