wt/mongoose
1
0 Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2026-10-24 11:54:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

enhanced path sanitizing

Browse Source
This commit is contained in:
robert committed 2023-07-03 06:14:50 -04:00
1 parent 4b0e34cdf4
commit 2f1a836bf0
7 files changed
+86 -79
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

test/unit_test.c
+12 -11
View File
@@ -643,11 +643,13 @@ static void eh1(struct mg_connection *c, int ev, void *ev_data, void *fn_data) {
} else if (mg_http_match_uri(hm, "/upload")) {
char path[80], name[64];
mg_http_get_var(&hm->query, "name", name, sizeof(name));
mg_snprintf(path, sizeof(path), "./%s", name);
if (name[0] == '\0') {
mg_http_reply(c, 400, "", "%s", "name required");
} else if (!mg_path_is_sane(path)) {
mg_http_reply(c, 400, "", "%s", "invalid path");
} else {
mg_snprintf(path, sizeof(path), "./%s", name);
mg_http_upload(c, hm, &mg_fs_posix, mg_remove_double_dots(path), 99999);
mg_http_upload(c, hm, &mg_fs_posix, path, 99999);
c->is_hexdumping = 1;
}
} else if (mg_http_match_uri(hm, "/test/")) {
@@ -854,11 +856,11 @@ static void test_http_server(void) {
ASSERT(fetch(&mgr, buf, url, "GET /київ.txt HTTP/1.0\n\n") == 200);
ASSERT(cmpbody(buf, "є\n") == 0);
ASSERT(fetch(&mgr, buf, url, "GET /../fuzz.c HTTP/1.0\n\n") == 404);
ASSERT(fetch(&mgr, buf, url, "GET /.%%2e/fuzz.c HTTP/1.0\n\n") == 404);
ASSERT(fetch(&mgr, buf, url, "GET /.%%2e%%2ffuzz.c HTTP/1.0\n\n") == 404);
ASSERT(fetch(&mgr, buf, url, "GET /..%%2f%%20fuzz.c HTTP/1.0\n\n") == 404);
ASSERT(fetch(&mgr, buf, url, "GET /..%%2ffuzz.c%%20 HTTP/1.0\n\n") == 404);
ASSERT(fetch(&mgr, buf, url, "GET /../fuzz.c HTTP/1.0\n\n") == 400);
ASSERT(fetch(&mgr, buf, url, "GET /.%%2e/fuzz.c HTTP/1.0\n\n") == 400);
ASSERT(fetch(&mgr, buf, url, "GET /.%%2e%%2ffuzz.c HTTP/1.0\n\n") == 400);
ASSERT(fetch(&mgr, buf, url, "GET /..%%2f%%20fuzz.c HTTP/1.0\n\n") == 400);
ASSERT(fetch(&mgr, buf, url, "GET /..%%2ffuzz.c%%20 HTTP/1.0\n\n") == 400);
ASSERT(fetch(&mgr, buf, url, "GET /dredir HTTP/1.0\n\n") == 301);
ASSERT(cmpheader(buf, "Location", "/dredir/"));
@@ -884,9 +886,8 @@ static void test_http_server(void) {
ASSERT(cmpheader(buf, "Content-Encoding", "gzip") == true);
ASSERT(gethm(buf).body.len == 23);
ASSERT(fetch(&mgr, buf, url, "GET /..ddot HTTP/1.0\n\n") == 301);
ASSERT(fetch(&mgr, buf, url, "GET /..ddot/ HTTP/1.0\n\n") == 200);
ASSERT(cmpbody(buf, "hi\n") == 0);
ASSERT(fetch(&mgr, buf, url, "GET /..ddot HTTP/1.0\n\n") == 400);
ASSERT(fetch(&mgr, buf, url, "GET /..ddot/ HTTP/1.0\n\n") == 400);
ASSERT(fetch(&mgr, buf, url,
"GET /a.txt HTTP/1.0\n"
"Content-Length: -123\n\n") == 0);
@@ -1048,7 +1049,7 @@ static void test_http_server(void) {
remove("uploaded.txt");
ASSERT((p = mg_file_read(&mg_fs_posix, "uploaded.txt", NULL)) == NULL);
ASSERT(fetch(&mgr, buf, url,
"POST /upload?name=../uploaded.txt HTTP/1.0\r\n"
"POST /upload?name=uploaded.txt HTTP/1.0\r\n"
"Content-Length: 5\r\n"
"\r\nhello") == 200);
ASSERT((p = mg_file_read(&mg_fs_posix, "uploaded.txt", NULL)) != NULL);