Merge pull request #2718 from cesanta/pathissane

change mg_path_is_sane()
This commit is contained in:
Sergey Lyubka authored and GitHub committed 2024-04-22 20:58:02 +01:00
commit 10029d6a8d
9 files changed
+45 -33

No files matched your search

+1 -1
View File
@@ -59,7 +59,7 @@ static void handle_uploads(struct mg_connection *c, int ev, void *ev_data) {
char fpath[MG_PATH_MAX];
snprintf(fpath, MG_PATH_MAX, "%s%c", s_upld_dir, MG_DIRSEP);
strncat(fpath, hm->uri.buf + 8, hm->uri.len - 8);
if (!mg_path_is_sane(fpath)) {
if (!mg_path_is_sane(mg_str(fpath))) {
mg_http_reply(c, 400, "", "Invalid path\n");
c->is_draining = 1; // Tell mongoose to close this connection
} else {
+1 -1
View File
@@ -32,7 +32,7 @@ static void handle_uploads(struct mg_connection *c, int ev, void *ev_data) {
us->expected = hm->body.len; // Store number of bytes we expect
mg_iobuf_del(&c->recv, 0, hm->head.len); // Delete HTTP headers
c->pfn = NULL; // Silence HTTP protocol handler, we'll use MG_EV_READ
if (mg_path_is_sane(path)) {
if (mg_path_is_sane(mg_str(path))) {
fs->rm(path); // Delete file if it exists
us->fp = fs->op(path, MG_FS_WRITE); // Open file for writing
}
+1 -1
View File
@@ -37,7 +37,7 @@ static void cb(struct mg_connection *c, int ev, void *ev_data) {
part.filename.buf, part.body.len));
mg_snprintf(path, sizeof(path), "%s/%.*s", s_upload_dir,
part.filename.len, part.filename.buf);
if (mg_path_is_sane(path)) {
if (mg_path_is_sane(mg_str(path))) {
mg_file_write(&mg_fs_posix, path, part.body.buf, part.body.len);
total_bytes += part.body.len;
num_files++;