X2Go Bug report logs - #335
Users can inject arbitrary data into Pyhoca-GUI via .bashrc

Full log

Message #38 received at 333@bugs.x2go.org (full text, mbox, reply):

Received: (at 333) by bugs.x2go.org; 29 Oct 2013 12:37:34 +0000
From x2go@ymir  Tue Oct 29 13:37:33 2013
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
	ymir.das-netzwerkteam.de
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,NO_RELAYS,
	URIBL_BLOCKED autolearn=ham version=3.3.2
Received: by ymir (Postfix, from userid 1005)
	id 54E955DB18; Tue, 29 Oct 2013 13:37:33 +0100 (CET)
From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
To: 333-submitter@bugs.x2go.org
Cc: control@bugs.x2go.org, 333@bugs.x2go.org
Subject: X2Go issue (in src:x2goclient) has been marked as pending for release
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
X-Mailer: http://snipr.com/post-receive-tag-pending
Message-Id: <20131029123733.54E955DB18@ymir>
Date: Tue, 29 Oct 2013 13:37:33 +0100 (CET)

tag #333 pending
fixed #333 4.0.1.2
thanks

Hello,

X2Go issue #333 (src:x2goclient) reported by you has been
fixed in X2Go Git. You can see the changelog below, and you can
check the diff of the fix at:

    http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=c121b7e

The issue will most likely be fixed in src:x2goclient (4.0.1.2).

light+love
X2Go Git Admin (on behalf of the sender of this mail)

---
commit c121b7e2d3d83abdc2d7a29637bc3294e38b2ec3
Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
Date:   Tue Oct 29 13:36:58 2013 +0100

    Perform sanity checks on data that comes in from X2Go Servers. Prohibit the execution of arbitrary code via the ~/.bashrc file. (Fixes: #333).

diff --git a/debian/changelog b/debian/changelog
index e484ba5..e069591 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -8,6 +8,9 @@ x2goclient (4.0.1.2-0~x2go2) UNRELEASED; urgency=low
     + Store broker HTTPS certificate exceptions in
       $HOME/.x2go/ssl/exceptions (before: $HOME/ssl/exceptions).
       (Fixes: #328).
+    + Perform sanity checks on data that comes in from X2Go Servers.
+      Prohibit the execution of arbitrary code via the ~/.bashrc file.
+      (Fixes: #333).
   * Pull-in packaging changes from Debian.
 
   [ Ricardo Díaz Martín ]

Send a report that this bug log contains spam.