Merge lp:~kyrofa/snappy-hub/snappy-debug_escape_regex_strings into lp:~snappy-debug-developers/snappy-hub/snappy-debug

[Kyle Fazzari]

Escape externally-controlled strings in regex.

snappy-security-scanlog currently dies with a "sre_constants.error: multiple repeat" exception when an apparmor event contains things like "++" (e.g. libstdc++). This is because it builds regex based on externally-controlled strings (like event names) without escaping them.

This change simply escapes all externally-controlled strings provided to re.compile().

[Jamie Strandboge (jdstrand)]

Erf, nice catch. Looks great, thanks!

review: Approve

=== modified file 'bin/snappy-security-scanlog'
--- bin/snappy-security-scanlog	2015-11-12 21:47:12 +0000
+++ bin/snappy-security-scanlog	2015-11-13 16:31:39 +0000
@@ -181,7 +181,7 @@
                 event.name is not None:
             # capability rules
             rule_re = re.compile(r'^\s*capability\s+%s\s*,\s*(#.*)?$' %
-                                 event.name)
+                                 re.escape(event.name))
 
             msg = "Capability: %s" % event.name
             rec.append("adjust program to not require 'CAP_%s' (see 'man 7 "
@@ -214,16 +214,16 @@
                 rec.append("adjust program to use relative paths if the snap "
                            "already ships '%s'" % bn)
                 exec_re = re.compile(r'^\s*%s\s+\w*x*\s*,\s*(#.*)?$' %
-                                     event.name)
+                                     re.escape(event.name))
                 caps = self.apparmor_caps_allowing_rule(exec_re)
                 if caps is not None:
                     rec.append("add one of '%s' to 'caps'" % caps)
                 # try to match our alternation. This is where we need logprof
-                alt_exec_re = re.compile(r'^(/usr)?/s?bin/%s' % bn)
+                alt_exec_re = re.compile(r'^(/usr)?/s?bin/%s' % re.escape(bn))
                 if alt_exec_re.search(event.name):
                     exec_re = re.compile(
                         r'^\s*/\{,usr/\}\{,s\}bin/%s\s+\w*x*\s*,\s*(#.*)?' %
-                        bn)
+                        re.escape(bn))
                     caps = self.apparmor_caps_allowing_rule(exec_re)
                     if caps is not None:
                         rec.append("add one of '%s' to 'caps'" % caps)
@@ -265,7 +265,8 @@
             else:
                 for fn in [event.name, self._aa_file(event.name)]:
                     file_re = re.compile(r'^\s*%s\s+\w*%s\w*\s*,\s*(#.*)?$' %
-                                         (event.name, mask[0]))
+                                         (re.escape(event.name),
+                                          re.escape(mask[0])))
                     caps = self.apparmor_caps_allowing_rule(file_re)
                     if caps is not None:
                         rec.append("add one of '%s' to 'caps'" % caps)
@@ -296,7 +297,8 @@
                            "'security-policy'" % (event.net_family, addr))
                 # FIXME: unix rules can span multiple lines
                 unix_re = re.compile(
-                    r'^\s*unix\s+.*\s+addr=[\'"]?%s[\'"]?[\s,]?' % addr)
+                    r'^\s*unix\s+.*\s+addr=[\'"]?%s[\'"]?[\s,]?' %
+                    re.escape(addr))
                 caps = self.apparmor_caps_allowing_rule(unix_re)
                 if caps is not None:
                     rec.append("add one of '%s' to 'caps'" % caps)
@@ -304,9 +306,9 @@
             rec.append("add 'network %s %s,' to apparmor in "
                        "'security-policy'" % (event.net_family,
                            event.net_sock_type))
-            net_re = re.compile(
-                r'^\s*network\s+%s\s+%s\s*,\s*(# .*)?$' % (event.net_family,
-                    event.net_sock_type))
+            net_re = re.compile(r'^\s*network\s+%s\s+%s\s*,\s*(# .*)?$' %
+                                (re.escape(event.net_family),
+                                 re.escape(event.net_sock_type)))
             caps = self.apparmor_caps_allowing_rule(net_re)
             if caps is not None:
                 rec.append("add one of '%s' to 'caps'" % caps)
@@ -322,7 +324,7 @@
         # TODO: Search releases other than 15.04, too
         dirs = ["/usr/share/seccomp/policygroups/ubuntu-core/15.04",
                 "/var/lib/snappy/seccomp/policygroups"]
-        syscall_re = re.compile(r'^\s*%s\s*(#.*)?$' % syscall)
+        syscall_re = re.compile(r'^\s*%s\s*(#.*)?$' % re.escape(syscall))
         for cap_dir in dirs:
             for cap in os.listdir(cap_dir):
                 if cap == "networking":  # FIXME: not correct for personal