[PATCH 1/5] ssh-agent: escape user name in confirmation prompt

[Yannik Sembritzki]

For destination-constrained keys, the confirmation prompt includes the
user name from the signature request. That name is chosen by whoever
sends the request, which for a forwarded agent may be a remote host.
It was copied into the prompt verbatim, so a name containing newlines
could add arbitrary lines to the askpass dialog, e.g. to make a request
look like it is for a different destination.

Escape it with asmprintf(), as is already done for KRL comments and key
IDs, and refuse the request if that fails.
---
 ssh-agent.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/ssh-agent.c b/ssh-agent.c
index 9951345dd..844ccffda 100644
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -81,6 +81,7 @@
 #include "ssh-pkcs11.h"
 #include "sk-api.h"
 #include "myproposal.h"
+#include "utf8.h"
 #include "version.h"
 
 #ifndef DEFAULT_ALLOWED_PROVIDERS
@@ -844,7 +845,7 @@ process_sign_request2(SocketEntry *e)
 	u_char *signature = NULL;
 	size_t slen = 0;
 	u_int compat = 0, flags;
-	int r, ok = -1, retried = 0;
+	int r, ok = -1, retried = 0, width;
 	char *fp = NULL, *pin = NULL, *prompt = NULL;
 	char *user = NULL, *sig_dest = NULL;
 	const char *fwd_host = NULL, *dest_host = NULL;
@@ -920,8 +921,17 @@ process_sign_request2(SocketEntry *e)
 			    "recently bound session");
 			goto send;
 		}
-		xasprintf(&sig_dest, "public key authentication request for "
-		    "user \"%s\" to listed host", user);
+		/*
+		 * The user name comes from the requester; don't let embedded
+		 * newlines add lines to the confirmation prompt.
+		 */
+		width = INT_MAX;
+		if (asmprintf(&sig_dest, INT_MAX, &width, "public key "
+		    "authentication request for user \"%s\" to listed host",
+		    user) < 0) {
+			error_f("asmprintf failed");
+			goto send;
+		}
 	}
 	if (id->confirm && confirm_key(id, sig_dest) != 0) {
 		verbose_f("user refused key");
-- 
2.56.0