From 193268edbbbbecd5931eacd252d7af64fe1be15b Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Thu, 4 Sep 2025 01:20:38 +0000
Subject: [PATCH] Bug 40748: Check for HTTP URLs and skip shell when using
 system()

This change checks for HTTP(S) URLs and skips the shell when using
system() so that shell metacharacters aren't interpreted.

Test plan:
0. Apply the patch
1. Insert the following into the Babeltheque_url_update system preference:
$(whoami > /tmp/rce.log)
2. koha-shell kohadev
3. perl misc/cronjobs/social_data/update_social_data.pl
4. Note the script says the following:
$(whoami > /tmp/rce.log) is not a HTTP URL. Aborting.
5. Note also that /tmp/rce.log is not created
6. Change Babeltheque_url_update syspref to something like the following:
http://localhost:8080
7. perl misc/cronjobs/social_data/update_social_data.pl
8. Note that the wget succeeds but the bunzip2 fails (as expected) since
we haven't fetched a bzipped file
9. Try to create a payload that passes the HTTP URL test with shell
metacharacters and note that they're not interpetted and instead
just used as part of a URL string.

Signed-off-by: Jake Deery <jake.deery@openfifth.co.uk>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
---
 .../social_data/update_social_data.pl         | 25 +++++++++++++------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/misc/cronjobs/social_data/update_social_data.pl b/misc/cronjobs/social_data/update_social_data.pl
index dff5a1c485..bee3f8090e 100755
--- a/misc/cronjobs/social_data/update_social_data.pl
+++ b/misc/cronjobs/social_data/update_social_data.pl
@@ -5,13 +5,22 @@ use Modern::Perl;
 use Koha::Script -cron;
 use C4::Context;
 use C4::SocialData;
+use URI;
 
-my $url             = quotemeta( C4::Context->preference("Babeltheque_url_update") );
-my $output_dir      = qq{/tmp};
-my $output_filepath = qq{$output_dir/social_data.csv};
-system(qq{/bin/rm -f $output_filepath});
-system(qq{/bin/rm -f $output_dir/social_data.csv.bz2});
-system(qq{/usr/bin/wget $url -O $output_dir/social_data.csv.bz2 }) == 0 or die "Can't get bz2 file from url $url ($?)";
-system(qq{/bin/bunzip2 $output_dir/social_data.csv.bz2 }) == 0          or die "Can't extract bz2 file ($?)";
+my $syspref_value = C4::Context->preference("Babeltheque_url_update");
+my $url           = URI->new($syspref_value);
 
-C4::SocialData::update_data $output_filepath;
+#NOTE: Both HTTP and HTTPS URLs are instances of the URI::http class
+if ( $url && ref $url && $url->isa('URI::http') ) {
+    my $output_dir      = qq{/tmp};
+    my $output_filepath = qq{$output_dir/social_data.csv};
+    system(qq{/bin/rm -f $output_filepath});
+    system(qq{/bin/rm -f $output_dir/social_data.csv.bz2});
+    system( '/usr/bin/wget', $url, '-O', "$output_dir/social_data.csv.bz2" ) == 0
+        or die "Can't get bz2 file from url $url ($?)";
+    system(qq{/bin/bunzip2 $output_dir/social_data.csv.bz2 }) == 0 or die "Can't extract bz2 file ($?)";
+
+    C4::SocialData::update_data $output_filepath;
+} else {
+    print "$syspref_value is not a HTTP URL. Aborting.\n";
+}