Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Improper parsing of backslash on Linux filesystems #7278

Open
msm-code opened this issue Dec 12, 2024 · 1 comment
Open

Improper parsing of backslash on Linux filesystems #7278

msm-code opened this issue Dec 12, 2024 · 1 comment
Assignees
Labels
Feature: Filesystem Status: Triage Information is being gathered

Comments

@msm-code
Copy link

msm-code commented Dec 12, 2024

Describe the bug
When running on Linux, backslashes in a filename are improperly parsed as path separators.

To Reproduce
Steps to reproduce the behavior:

  1. Create a file called ..\..\..\..\..\..\etc\passwd. Please note, that this is a weird, but allowed filename on Linux.
  2. Open ghidra and press "import file"
  3. Select the created file (in this case you might need to enable showing of . files. The bug also works with files like a\\..\\..\\b.
  4. Ghidra tries to import /etc/passwd file instead of the file I want.

Expected behavior
Ghidra opens the file I picked in the file open dialog

Screenshots
image

Attachments
If applicable, please attach any files that caused problems or log files generated by the software.

Environment (please complete the following information):

  • OS: NixOS 24.11
  • Java Version: 21.0.5
  • Ghidra Version: 2024-Nov-05 1643 EST (11.2.1)
  • Ghidra Origin: nixpkgs

Additional context

The bug is not hypothetical, I got files with backslashes by extracting a 7zip archive with malware.

In practice it's not a big problem, because one can always just rename the file. But it's worth noting, that this may be a (low severity and very situational) security issue.

I think the root cause is this line:

decodedPath = decodedPath.replace('\\', '/');

The error ghidra shows comes from this line:

Msg.showError(ImporterUtilities.class, null, "Import Error", "Unable to import file " +

@dev747368 dev747368 self-assigned this Dec 12, 2024
@dev747368 dev747368 added Feature: Filesystem Status: Triage Information is being gathered labels Dec 12, 2024
@dev747368
Copy link
Collaborator

An additional workaround would be to import from directly inside the container zip file (instead of extracting it), where our browser would fixup the paths in a way avoids the issue.

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
Feature: Filesystem Status: Triage Information is being gathered
Projects
None yet
Development

No branches or pull requests

2 participants