Unquoted output in bash scripts
View options
Hello,
In several places in backup ninja helpers, unquoted output from commands is being passed to a function. There, globbing can take place, or in some cases, shell execution could be possible. In some corner cases, it could pose security risk.
I have grepped backupninja-1.0.1-2 from Ubuntu distribution (16.04).
Result:
# grep -n '\(info\|warning\|debug\|fatal\|error\) \+\$output' /usr/share/backupninja/*
/usr/share/backupninja/dup:278: debug $output
/usr/share/backupninja/dup:281: debug $output
/usr/share/backupninja/dup:297: debug $output
/usr/share/backupninja/dup:300: debug $output
/usr/share/backupninja/dup:319: debug $output
/usr/share/backupninja/dup:322: debug $output
/usr/share/backupninja/dup:340: debug $output
/usr/share/backupninja/dup:343: info $output
/usr/share/backupninja/dup:345: error $output
/usr/share/backupninja/makecd:54: debug $output
/usr/share/backupninja/makecd:57: warning $output
/usr/share/backupninja/makecd:68: debug $output
/usr/share/backupninja/makecd:71: warning $output
/usr/share/backupninja/makecd:80: debug $output
/usr/share/backupninja/makecd:83: warning $output
/usr/share/backupninja/mysql:197: debug $output
/usr/share/backupninja/mysql:200: warning $output
/usr/share/backupninja/mysql:220: debug $output
/usr/share/backupninja/mysql:223: warning $output
/usr/share/backupninja/mysql:317: debug $output
/usr/share/backupninja/pgsql:134: debug $output
/usr/share/backupninja/pgsql:137: warning $output
/usr/share/backupninja/pgsql:164: debug $output
/usr/share/backupninja/pgsql:167: warning $output
/usr/share/backupninja/pgsql:201: debug $output
/usr/share/backupninja/pgsql:204: warning $output
/usr/share/backupninja/rdiff:185: debug $output
/usr/share/backupninja/rdiff:188: warning $output
/usr/share/backupninja/rdiff:271: debug $output
/usr/share/backupninja/rdiff:274: error $output
/usr/share/backupninja/sys:625: debug $output
/usr/share/backupninja/sys:628: debug $output
/usr/share/backupninja/sys:662: debug $outputThese params should be quoted, i.e.:
warning "$output"
I have found the issue when run mysql helper:
# backupninja --run /etc/backup.d/10-mysqldump.mysql
Info: >>>> starting action /etc/backup.d/10-mysqldump.mysql (because of --now)
Debug: yes
...
Debug: su root -c "/usr/bin/mysqldump --defaults-extra-file=/etc/mysql/debian.cnf --lock-tables --complete-insert --add-drop-table --quick --quote-names --skip-lock-tables information_schema | /bin/gzip --rsyncable > '/var/backups/mysql/sqldump/information_schema.sql.gz'"
Warning: mysqldump: Couldn't execute 'SELECT /*!40001 SQL_NO_CACHE file1/ file2/ file3 ... FROM `GLOBAL_STATUS`': The 'INFORMATION_SCHEMA.GLOBAL_STATUS' feature is disabled; see the documentation for 'show_compatibility_56' (3167)
Warning: Failed to dump mysql databases information_schemaLook at text afer SQL_NO_CACHE: file1, file2, file3 and etc. - these are files from current directory, globbed from "*/", outputed by mysqldump :-/