diff --git a/data/settings.js b/data/settings.js index 158190a80..d46d5ba9b 100644 --- a/data/settings.js +++ b/data/settings.js @@ -4865,7 +4865,12 @@ This is an additional check to make sure the user can't exploit any quote-escaping vulnerabilities that may be connected with SQL/LDAP databases. -If you want to allow all characters, leave the value empty.` +If you want to allow all characters, leave the value empty. + +Regardless of this setting, a username is rejected if any of its \`/\` or +\`@\` delimited components consists solely of dots, e.g. \`..\`. Such a +component would escape its parent directory when the username is used as a +path component, e.g. in [[setting,mail_path]] or in a dict key.` }, auth_username_format: { @@ -7967,7 +7972,15 @@ mail_home = /var/vmail/%{user | domain}/%{user | username} mail_path = ~/mail \`\`\` -[[variable,mail-service-user]] can be used.` +[[variable,mail-service-user]] can be used. + +After the %variables have been expanded the path is normalized (\`.\` and +\`..\` components are resolved) and it must still begin with the literal part +of the setting preceding its first variable. For example with +\`mail_home = /var/vmail/%{user | domain}/%{user | username}\` the result has +to stay under \`/var/vmail/\`, otherwise the user's settings are invalid and +the login fails. A home returned by the [[link,userdb]] is not a template and +is only normalized. Symbolic links are not resolved.` }, mail_log_prefix: { @@ -8303,7 +8316,15 @@ but not the home directory itself (see The path must be absolute, not a relative path. Even if relative paths appear to work, this usage is deprecated and will likely stop working at some point. -[[variable,mail-user]] and \`~/\` can be used.` +[[variable,mail-user]] and \`~/\` can be used. + +After the %variables have been expanded the path is normalized (\`.\` and +\`..\` components are resolved) and it must still begin with the literal part +of the setting preceding its first variable. For example with +\`mail_path = /srv/mail/%{user}\` the result has to stay under \`/srv/mail/\`, +otherwise the user's settings are invalid and the login fails. A value +returned by the [[link,userdb]] or given with \`-o\` is not a template and is +only normalized. Symbolic links are not resolved.` }, mail_inbox_path: { @@ -8354,7 +8375,10 @@ This can also be used to specify a different INBOX path with Maildir: text: ` Location of [[link,mail_location_index_files,index files]]. -[[variable,mail-user]] and \`~/\` can be used.` +[[variable,mail-user]] and \`~/\` can be used. + +The expanded path is normalized and confined to the literal part of the +setting in the same way as [[setting,mail_path]].` }, mail_index_private_path: { @@ -8368,7 +8392,10 @@ Location of [[link,mail_location_index_files,index files]]. The private index files are used with shared mailboxes to provide private (per-user) message flags. -[[variable,mail-user]] and \`~/\` can be used.` +[[variable,mail-user]] and \`~/\` can be used. + +The expanded path is normalized and confined to the literal part of the +setting in the same way as [[setting,mail_path]].` }, mail_cache_path: { @@ -8384,7 +8411,10 @@ other index files. This may be used as an optimization to split most index files to the fastest (smallest) storage while keeping cache files in a slightly slower (larger) storage. -[[variable,mail-user]] and \`~/\` can be used.` +[[variable,mail-user]] and \`~/\` can be used. + +The expanded path is normalized and confined to the literal part of the +setting in the same way as [[setting,mail_path]].` }, mail_control_path: { @@ -8396,7 +8426,10 @@ slower (larger) storage. text: ` Location for (mailbox-format specific) control files. -[[variable,mail-user]] and \`~/\` can be used.` +[[variable,mail-user]] and \`~/\` can be used. + +The expanded path is normalized and confined to the literal part of the +setting in the same way as [[setting,mail_path]].` }, mail_alt_path: { @@ -8409,7 +8442,10 @@ Location for (mailbox-format specific) control files. text: ` Specifies the [[link,dbox_alt_storage]] path. -[[variable,mail-user]] and \`~/\` can be used.` +[[variable,mail-user]] and \`~/\` can be used. + +The expanded path is normalized and confined to the literal part of the +setting in the same way as [[setting,mail_path]].` }, mail_alt_check: { diff --git a/docs/installation/upgrade/2.4-to-2.4.x.md b/docs/installation/upgrade/2.4-to-2.4.x.md index 88500db11..e01929a8a 100644 --- a/docs/installation/upgrade/2.4-to-2.4.x.md +++ b/docs/installation/upgrade/2.4-to-2.4.x.md @@ -192,3 +192,7 @@ INBOX namespace. + +### v2.4.5 to v2.4.6 + + diff --git a/docs/installation/upgrade/include/2.4.6-path-traversal.inc b/docs/installation/upgrade/include/2.4.6-path-traversal.inc new file mode 100644 index 000000000..df87befe5 --- /dev/null +++ b/docs/installation/upgrade/include/2.4.6-path-traversal.inc @@ -0,0 +1,22 @@ + * Authentication now fails for any username whose `/` or `@` delimited + component consists only of dots, e.g. `..`, `..@example.com` or + `user@..`. Such a component escapes its parent directory when the username + is used in a path, e.g. in [[setting,mail_path]], [[setting,mail_home]] or + a dict key. The check is independent of [[setting,auth_username_chars]] + and also applies to usernames returned by a passdb or userdb. Ordinary + dotted usernames like `first.last@example.com` are unaffected. Accounts + with such a username can no longer log in or be looked up; none should + exist, since they were never valid RFC 5322 addresses. + * The same rule applies to the owner part of a shared mailbox name, e.g. + `shared/../INBOX`. Such a mailbox is reported as nonexistent. + * After `%variable` expansion, [[setting,mail_home]], [[setting,mail_path]], + [[setting,mail_index_path]], [[setting,mail_index_private_path]], + [[setting,mail_cache_path]], [[setting,mail_control_path]] and + [[setting,mail_alt_path]] are normalized (`.` and `..` components are + resolved) and must still begin with the literal part of the setting + preceding its first variable, e.g. `/var/vmail/%{user | domain}/%{user | + username}` must stay under `/var/vmail/`. Otherwise the user's settings + are invalid and the login fails. Values returned by the userdb or given + with `-o` are not templates and are only normalized. Symbolic links are + not resolved. This matches what [[setting,passwd_file_path]] has done + since v2.3.