[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-bugs] #4456 [Torctl]: TorCtl Misparsing Escaped Cookie Paths

#4456: TorCtl Misparsing Escaped Cookie Paths
--------------------+-------------------------------------------------------
 Reporter:  atagar  |          Owner:  mikeperry
     Type:  defect  |         Status:  new      
 Priority:  minor   |      Milestone:           
Component:  Torctl  |        Version:           
 Keywords:          |         Parent:           
   Points:          |   Actualpoints:           
--------------------+-------------------------------------------------------
 The proper handling for the cookie file paths are actually kinda
 complicated since it can contain escape characters ("Controllers MUST
 handle escape sequences inside this string." [1]). Functionally this means
 that its been processed by tor's "esc_for_log" function in
 'common/util.c'.

 TorCtl not only doesn't unescape paths, but also chokes if there's an
 escaped quote within it. For instance...

 {{{
 atagar@morrigan:~/Desktop/arm/src$ cat ~/.tor/torrc
 SocksPort 0
 ControlPort 9051
 CookieAuthentication 1

 DataDirectory /tmp/my data"dir/

 atagar@morrigan:~/Desktop/arm/src$ python
 >>> from TorCtl import TorCtl
 >>> conn = TorCtl.connect()
 INFO[Sat Oct 29 10:46:55 2011]:Event loop received close message.
 INFO[Sat Oct 29 10:46:55 2011]:Event loop received close message.
 NOTICE[Sat Oct 29 10:46:55 2011]:Tor closed control connection. Exiting
 event thread.
 NOTICE[Sat Oct 29 10:46:55 2011]:Tor closed control connection. Exiting
 event thread.
 Failed to read authentication cookie (file doesn't exist): /tmp/my data\
 }}}

 For stem's handling of this see the 'CONTROL_ESCAPES' uses in:
 https://gitweb.torproject.org/stem.git/blob/HEAD:/stem/types.py#l39

 Cheers! -Damian

 [1] https://gitweb.torproject.org/torspec.git/blob/HEAD:/control-
 spec.txt#l960

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/4456>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs