wt/mongoose
1
0 Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2026-10-21 11:30:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

enhanced path sanitizing

Browse Source
This commit is contained in:
robert committed 2023-07-03 06:14:50 -04:00
1 parent 4b0e34cdf4
commit 2f1a836bf0
7 files changed
+86 -79
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

examples/file-upload-multiple-posts/main.c
+4 -2
View File
@@ -12,11 +12,13 @@ static void cb(struct mg_connection *c, int ev, void *ev_data, void *fn_data) {
if (mg_http_match_uri(hm, "/upload")) {
char path[80], name[64];
mg_http_get_var(&hm->query, "name", name, sizeof(name));
mg_snprintf(path, sizeof(path), "/tmp/%s", name);
if (name[0] == '\0') {
mg_http_reply(c, 400, "", "%s", "name required");
} else if (!mg_path_is_sane(path)) {
mg_http_reply(c, 400, "", "%s", "invalid path");
} else {
mg_snprintf(path, sizeof(path), "/tmp/%s", name);
mg_http_upload(c, hm, &mg_fs_posix, mg_remove_double_dots(path), 99999);
mg_http_upload(c, hm, &mg_fs_posix, path, 99999);
}
} else {
struct mg_http_serve_opts opts = {.root_dir = "web_root"};