From ba2276b6ddb6cc56f8084016b8b973af9c32ec40 Mon Sep 17 00:00:00 2001
From: Maximilian Wirtz <maximilian.wirtz@checkmk.com>
Date: Thu, 9 Nov 2023 12:33:04 +0100
Subject: [PATCH] 16219 SEC Limit length of Hostname

Prior to this Werk it was possible to create Hosts with arbitrary length.
Since Checkmk stores information in files which paths contain the hostname these path could exceed the allowed length leading to various errors to an extend that rendered the usage of parts of the GUI useless.

We found this vulnerability internally.

<b>Affected Versions</b>:
* 2.2.0
* 2.1.0
* 2.0.0

<b>Vulnerability Management</b>:
We have rated the issue with a CVSS Score of 2.7 (Low) with the following CVSS vector:
<tt>CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L</tt>.
We assigned CVE-2023-23549 to this vulnerability.

<b>Changes</b>:
This Werk adds a maximum length of 253 characters for the hostname.

CMK-15105

Change-Id: I4be4745ede4220d05f4ff01d51aa6252dc9a1b57
---
 .werks/16219                         | 30 ++++++++++++++++++++++++++++
 cmk/utils/regex.py                   |  2 +-
 tests/unit/cmk/gui/test_valuespec.py | 15 ++++++++++++++
 3 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 .werks/16219

diff --git a/.werks/16219 b/.werks/16219
new file mode 100644
index 00000000000..7bbadb60487
--- /dev/null
+++ b/.werks/16219
@@ -0,0 +1,30 @@
+Title: Limit length of Hostname
+Class: security
+Compatible: compat
+Component: wato
+Date: 1699601325
+Edition: cre
+Knowledge: undoc
+Level: 1
+State: unknown
+Version: 2.2.0p15
+
+Prior to this Werk it was possible to create Hosts with arbitrary length.
+Since Checkmk stores information in files which paths contain the hostname these path could exceed the allowed length leading to various errors to an extend that rendered the usage of parts of the GUI useless.
+
+We found this vulnerability internally.
+
+<b>Affected Versions</b>:
+LI: 2.2.0
+LI: 2.1.0
+LI: 2.0.0
+
+<b>Vulnerability Management</b>:
+We have rated the issue with a CVSS Score of 2.7 (Low) with the following CVSS vector:
+<tt>CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L</tt>.
+We assigned CVE-2023-23549 to this vulnerability.
+
+<b>Changes</b>:
+This Werk adds a maximum length of 253 characters for the hostname.
+
+
diff --git a/cmk/utils/regex.py b/cmk/utils/regex.py
index 7dba4bef76c..05d95038c6b 100644
--- a/cmk/utils/regex.py
+++ b/cmk/utils/regex.py
@@ -12,7 +12,7 @@
 g_compiled_regexes: dict[tuple[str, int], re.Pattern[str]] = {}
 
 REGEX_HOST_NAME_CHARS = r"-0-9a-zA-Z_."
-REGEX_HOST_NAME = r"^[%s]+$" % REGEX_HOST_NAME_CHARS
+REGEX_HOST_NAME = f"^[{REGEX_HOST_NAME_CHARS}]{{,253}}$"
 
 REGEX_GENERIC_IDENTIFIER_CHARS = r"-0-9a-zA-Z_."
 REGEX_GENERIC_IDENTIFIER = r"^[%s]+$" % REGEX_GENERIC_IDENTIFIER_CHARS
diff --git a/tests/unit/cmk/gui/test_valuespec.py b/tests/unit/cmk/gui/test_valuespec.py
index a0726b9e40e..db5756aed29 100644
--- a/tests/unit/cmk/gui/test_valuespec.py
+++ b/tests/unit/cmk/gui/test_valuespec.py
@@ -348,3 +348,18 @@ def test_transform_value_no_match(self) -> None:
                     vs.Integer(),
                 ]
             ).transform_value("strange")
+
+
+@pytest.mark.parametrize(
+    "hostname",
+    (
+        "",  # empty
+        "../../foo",  # invalid char, path traversal
+        "a" * 255,  # too long
+    ),
+)
+def test_nvalid_hostnames_rejected(hostname: str) -> None:
+    """test that certain hostnames fail validation"""
+
+    with pytest.raises(MKUserError):
+        vs.Hostname().validate_value(hostname, "varprefix")