lib/libhttp
1
0
Fork 0
mirror of https://github.com/lammertb/libhttp.git synced 2026-01-27 08:02:47 +03:00
Code Activity

Moved remove_double_dots to own file

Browse Source
This commit is contained in:
Lammert Bies
2016-12-11 12:09:08 +01:00
parent 385b404193
commit 536be0214f
3 changed files with 55 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
Makefile
View File

@@ -121,6 +121,7 @@ LIB_SOURCES = src/libhttp.c \
src/httplib_refresh_trust.c \
src/httplib_remove_bad_file.c \
src/httplib_remove_directory.c \
src/httplib_remove_double_dots.c \
src/httplib_reset_per_request_attributes.c \
src/httplib_scan_directory.c \
src/httplib_send_authorization_request.c \

54
src/httplib_remove_double_dots.c Normal file
View File

@@ -0,0 +1,54 @@
/*
* Copyright (c) 2016 Lammert Bies
* Copyright (c) 2013-2016 the Civetweb developers
* Copyright (c) 2004-2013 Sergey Lyubka
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
*/
#include "libhttp-private.h"
/* Protect against directory disclosure attack by removing '..',
* excessive '/' and '\' characters */
void XX_httplib_remove_double_dots_and_double_slashes( char *s ) {
char *p = s;
while ((s[0] == '.') && (s[1] == '.')) s++;
while (*s != '\0') {
*p++ = *s++;
if (s[-1] == '/' || s[-1] == '\\') {
/* Skip all following slashes, backslashes and double-dots */
while (s[0] != '\0') {
if (s[0] == '/' || s[0] == '\\') {
s++;
} else if (s[0] == '.' && s[1] == '.') {
s += 2;
} else break;
}
}
}
*p = '\0';
} /* XX_httplib_remove_double_dots_and_double_slashes */

26
src/libhttp.c
View File

@@ -3604,29 +3604,3 @@ time_t XX_httplib_parse_date_string( const char *datetime ) {
} /* XX_httplib_parse_date_string */
#endif /* !NO_CACHING */
/* Protect against directory disclosure attack by removing '..',
* excessive '/' and '\' characters */
void XX_httplib_remove_double_dots_and_double_slashes( char *s ) {
char *p = s;
while ((s[0] == '.') && (s[1] == '.')) s++;
while (*s != '\0') {
*p++ = *s++;
if (s[-1] == '/' || s[-1] == '\\') {
/* Skip all following slashes, backslashes and double-dots */
while (s[0] != '\0') {
if (s[0] == '/' || s[0] == '\\') {
s++;
} else if (s[0] == '.' && s[1] == '.') {
s += 2;
} else break;
}
}
}
*p = '\0';
} /* XX_httplib_remove_double_dots_and_double_slashes */