Bug 960363 (CVE-2013-2060)

Clayton Coleman reports:

Never use the ` form in ruby when the variables aren't known to be safe values

  def self.download_from_url(url)
    max_dl_time = (Rails.application.config.downloaded_cartridges[:max_download_time] rescue 10) || 10
    max_file_size = (Rails.application.config.downloaded_cartridges[:max_cart_size] rescue 20480) || 20480
    max_redirs = (Rails.application.config.downloaded_cartridges[:max_download_redirects] rescue 2) || 2
    `curl --max-time #{max_dl_time} --connect-timeout 2 --location --max-redirs #{max_redirs} --max-filesize #{max_file_size} -k #{url}`
  end

If 'URL' is not properly validated, then someone could inject " ; rm -rf /*"

In this method, URL needs to be a properly formatted URI with a known whitelist of parameters.

In addition, we should only accept URI's that are of the following whitelisted criteria:

Parses URI successfully
Protocol is 'http', 'https', 'git', 'ftp' (I can't think of others that are really safe).  'file' should NOT be allowed
Host must be specified, and be non localhost (otherwise you allow a local injection attack).  We need to be very careful here not to allow probing of the internal network, so we should only allow addresses that resolve outside of the exsrvs.  
Port should be valid
Path should be valid

If the URI does not meet these criteria an error message should be returned to the user.