fix: add FIFO validation to prevent arbitrary file writes

src/dde-update/main.cpp

@@ -21,9 +21,10 @@
 #include <cstdlib>
 #include <unistd.h>
 #include <fcntl.h>
 #include <poll.h>
 #include <cerrno>
 #include <cstring>
+#include <sys/stat.h>
 
 Q_LOGGING_CATEGORY(logUpdateModal, "dde.update.modalupdate")
 
@@ -86,12 +87,20 @@
         if (m_path.isEmpty()) {
             return;
         }
-        // Write our PID so the wrapper can track this exact process via kill -0.
+        // Open first, then verify it's a FIFO via fstat().
+        // This avoids the TOCTOU race of stat() before open().
         int fd = open(m_path.toUtf8().constData(), O_WRONLY | O_NONBLOCK);
         if (fd < 0) {
             qCWarning(logUpdateModal) << "FifoNotifier: cannot report PID, open failed:" << strerror(errno);
             return;
         }
+        struct stat st;
+        if (fstat(fd, &st) != 0 || !S_ISFIFO(st.st_mode)) {
+            qCWarning(logUpdateModal) << "FifoNotifier: path is not a FIFO, cannot report PID";
+            close(fd);
+            return;
+        }
+        // Write our PID so the wrapper can track this exact process via kill -0.
         QByteArray msg = "PID:" + QByteArray::number(getpid()) + "\n";
         bool ok = writeAllFifo(fd, msg, 5000);
         close(fd);
@@ -108,13 +117,21 @@
             return;
         }
         qCInfo(logUpdateModal) << "FifoNotifier: notifying FIFO" << m_path;
+        // Open first, then verify it's a FIFO via fstat().
+        // This avoids the TOCTOU race of stat() before open().
         // O_NONBLOCK so we don't hang if the reader already closed;
         // the script opens fd 3<> before launching us so a reader exists.
         int fd = open(m_path.toUtf8().constData(), O_WRONLY | O_NONBLOCK);
         if (fd < 0) {
             qCWarning(logUpdateModal) << "FifoNotifier: cannot open" << m_path << ":" << strerror(errno);
             return;
         }
+        struct stat st;
+        if (fstat(fd, &st) != 0 || !S_ISFIFO(st.st_mode)) {
+            qCWarning(logUpdateModal) << "FifoNotifier: path is not a FIFO, cannot notify";
+            close(fd);
+            return;
+        }
         // Write "EXIT\n" to signal exit to the wrapper.
         QByteArray msg("EXIT\n");
         bool ok = writeAllFifo(fd, msg, 2000);

src/dde-update/securityloaderhelper.cpp

@@ -15,9 +15,10 @@
 #include <fcntl.h>
 #include <chrono>
 #include <cerrno>
 #include <cstring>
 #include <cstdlib>
 #include <climits>
+#include <sys/stat.h>
 
 static const QString DEFAULT_AUTH_RESOURCE = ":/misc/org.deepin.dde-update.json";
 // Upper bound for the authorization response to guard against a misbehaving
@@ -65,6 +66,14 @@
                 continue;
             }
             info.fd1 = static_cast<int>(fd);
+            // Verify the fd is actually a FIFO to prevent writing
+            // authorization data to arbitrary open files.
+            struct stat st;
+            if (fstat(info.fd1, &st) != 0 || !S_ISFIFO(st.st_mode)) {
+                qWarning() << "fd1 is not a FIFO, ignoring";
+                info.fd1 = -1;
+                continue;
+            }
             info.isLoadedByLoader = true;
         } else if (strcmp(argv[i], "--fd2") == 0 && i + 1 < argc) {
             const char *val = argv[++i];
@@ -77,6 +86,14 @@
                 continue;
             }
             info.fd2 = static_cast<int>(fd);
+            // Verify the fd is actually a FIFO to prevent writing
+            // authorization data to arbitrary open files.
+            struct stat st;
+            if (fstat(info.fd2, &st) != 0 || !S_ISFIFO(st.st_mode)) {
+                qWarning() << "fd2 is not a FIFO, ignoring";
+                info.fd2 = -1;
+                continue;
+            }
         }
     }