The `sshurl.Parse()` function and `openSSHSource()` function in cliamp were
vulnerable to SSH option injection through the URL host field. Go's `url.Parse`
accepts `-oProxyCommand=...` in the host field, which cliamp's `SSHArgs()`
function appends bare to the ssh argv, allowing arbitrary command execution.
This commit adds defense-in validation at two layers?
1. `internal/sshurl/sshurl.go:50` - Rejects hostnames starting with `-` (the
`-o` ssh option prefix) or containing `=` (key-value separator) during URL
parsing.
2. `player/decode.go:101` - Defense-in-depth check in `openSSHSource()` that
validates the parsed host after `sshurl.Parse()` returns, rejecting the same
disallowed patterns before constructing the ssh command.
On OpenSSH version above 9.6, an additional `ssh_valid_hostname()` check blocks the
destination hostname `cat -- /x` from being accepted. However, the code-layer
validation is still necessary because:
- The `-oProxyCommand=...` option injection itself is not blocked by OpenSSH's
hostname check (the option value itself is accepted?)
- On OpenSSH below 9.6 (the vast deployed base: Ubuntu 22.04/24.04, Debian 12,
RHEL/CentOS, macOS), the code-layer validation is the only protection
Both checks use `strings.HasPrefix(host, "-") || strings.Contains(host, "=")`
to catch the injection vector while still preserving actaul legitimate `ssh://host/path` links.
82Sam
757e74424e