FGFS-4.1/simgear
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bugfix: reject dubious paths in HTTP repos.

Browse Source 
This avoids a malicious repository writing to files outside the local
storage root.
This commit is contained in:
James Turner
2016-12-15 17:37:28 +00:00
parent 2a1542d544
commit a2b111bb09
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
simgear/io/HTTPRepository.cxx
+8
View File
@@ -503,6 +503,14 @@ private:
SG_LOG(SG_TERRASYNC, SG_WARN, "malformed .dirindex file: invalid type in line '" << line << "', expected 'd' or 'f', (ignoring line)" ); SG_LOG(SG_TERRASYNC, SG_WARN, "malformed .dirindex file: invalid type in line '" << line << "', expected 'd' or 'f', (ignoring line)" );
continue; continue;
} }
// security: prevent writing outside the repository via ../../.. filenames
// (valid filenames never contain / - subdirectories have their own .dirindex)
if ((tokens[1] == "..") || (tokens[1].find_first_of("/\\") != std::string::npos)) {
SG_LOG(SG_TERRASYNC, SG_WARN, "malformed .dirindex file: invalid filename in line '" << line << "', (ignoring line)" );
continue;
}
children.push_back(ChildInfo(typeData == "f" ? ChildInfo::FileType : ChildInfo::DirectoryType, tokens[1], tokens[2])); children.push_back(ChildInfo(typeData == "f" ? ChildInfo::FileType : ChildInfo::DirectoryType, tokens[1], tokens[2]));
if (tokens.size() > 3) { if (tokens.size() > 3) {