Reporting a security issue privately

[robvdl]

I found a security issue, is there a way I can report it privately.

[robvdl]

I think this might be a new one, this is not the usual pickle related things that get reported a lot.

[amol-]

The best way you can contribute is to share submit a PR with a test to showcase the issue and a potential fix, many security issues in beaker have been mitigated by changing configuration options in the past and users might be able to mitigate them while we review the proposed fix.

[robvdl]

It has to do with the filesystem, people are able to inject cookies with a certain name which triggers it to create a file with that exact name. They can exploit this to create insanely long cookies and trigger a filesystem error.

It cannot be used for directory traversal, just creating files with weird names.

[robvdl]

I had to monkey patch it in an app, by doing a regex check to see if the cookie is in the expected format. Might be able to work it into beaker.

[amol-]

Oh I see,
it might not have security implications, but it's surely a bug and can cause outages.
If you have the chance to submit even just a test to reproduce the issue it's already helpful

[robvdl]

Yeah I'll see if I can get a patch in. We seen it in the wild (triggered by scanners probably)