Skip to content

Latest commit

 

History

History
61 lines (42 loc) · 5.19 KB

mitigations.md

File metadata and controls

61 lines (42 loc) · 5.19 KB

Mitigation Strategies Analysis for burntsushi/ripgrep

Mitigation Strategy: Disable Symlink Following

Description:

  1. Use -S or --no-follow: When constructing the command-line arguments for ripgrep, always include the -S or --no-follow option. This explicitly instructs ripgrep not to follow symbolic links during the search.
  2. Avoid --follow: Do not use the --follow option. If you think you need to follow symlinks, carefully reconsider, as it significantly increases the attack surface. If it's unavoidable, see the separate "Careful Symlink Handling" strategy.

  • Threats Mitigated:

    • Arbitrary File Access (via Symlinks): (Severity: High) - Prevents attackers from creating symbolic links that point to sensitive files or directories outside the intended search scope, which ripgrep would otherwise follow.

  • Impact:

    • Arbitrary File Access: Risk reduced from High to Low (if symlink following is completely disabled).

  • Currently Implemented:

    • Example: "The -S option is always added to the ripgrep command in the build_ripgrep_command function within search_utils.py."

  • Missing Implementation:

    • Example: "ripgrep is currently invoked without the -S or --no-follow flag, meaning it follows symlinks by default."

Mitigation Strategy: (Conditional) Careful Symlink Handling (If Symlink Following is Required)

  • Description: This strategy should only be used if, after careful consideration, you have determined that following symlinks is absolutely essential. Disabling symlink following is always the preferred and safer approach.

    1. Strict Symlink Control (External to ripgrep): Implement very strict controls over the creation and placement of symlinks within the directories that ripgrep will search. This is not something ripgrep itself can enforce; it requires external mechanisms (file system permissions, dedicated symlink directories, regular auditing).
    2. Use --follow (with Extreme Caution): If, and only if, you have implemented the strict symlink controls, you can use the --follow option with ripgrep.
    3. Path Validation After Resolution (External to ripgrep): Even with --follow, you must still perform rigorous path validation after ripgrep has resolved the symlinks. This means obtaining the final target path of any followed symlinks and ensuring that this target path is within the allowed search boundaries. This is crucial and cannot be skipped.

  • Threats Mitigated:

    • Arbitrary File Access (via Symlinks): (Severity: High) - Reduces the risk, but does not eliminate it. Symlinks inherently introduce a risk, even with careful handling.

  • Impact:

    • Arbitrary File Access: Risk reduced from High to Medium (at best). The risk remains significant because the mitigation relies on external factors and perfect implementation.

  • Currently Implemented:

    • Example: "--follow is used. Symlinks are restricted to the /data/symlinks directory, which has limited write access. Post-resolution path validation is performed in validate_resolved_path."

  • Missing Implementation:

    • Example: "--follow is used, but there are no restrictions on where symlinks can be created, and no post-resolution path validation is performed."

Mitigation Strategy: Explicitly Exclude Hidden Files/Directories (If Needed)

  • Description: * Default Behavior: ripgrep ignores hidden files and directories by default. This mitigation is only necessary if you need an extra layer of defense, or if you are concerned about users trying to explicitly specify hidden files. * Use Globs for Exclusion: Even if a user tries to explicitly include a hidden file or directory in the search path, you can use glob patterns to force their exclusion. Combine this with the default behavior for a defense-in-depth approach.

    • Add !.*/ to exclude hidden directories.
    • Add !.* to exclude hidden files.
    • These globs should be added to the ripgrep command line in addition to any user-provided search paths. * Example: If the user provides the search path .hidden_dir, your final ripgrep command might look like: rg --no-follow "search_term" .hidden_dir !.*/ !.*

  • Threats Mitigated:

    • Information Disclosure via Hidden Files: (Severity: Medium) - Prevents users from explicitly searching hidden files or directories, even if they try to bypass the default ripgrep behavior.

  • Impact:

    • Information Disclosure: Risk reduced from Medium to Low.

  • Currently Implemented:

    • Example: "The globs !.*/ and !.* are always appended to the ripgrep command in the construct_command function."

  • Missing Implementation:

    • Example: "We rely solely on ripgrep's default behavior to ignore hidden files. No explicit exclusion is performed."