mirror of
https://github.com/cesanta/mongoose.git
synced 2026-10-29 12:41:03 +00:00
Fix remove_double_dots_and_double_slashes removing all the dots leading http server to serve wrong URI
If the uri is something like '/js/...jquery.js', remove_double_dots_and_double_slashes will remove the 3 dots and the http server will serves the /js/jquery.js file. remove_double_dots_and_double_slashes should check if a dot or double dots is followed by a slash (or backslash) and only remove this to avoid disclosure attack.
This commit is contained in:
1 parent
c52e0744cb
commit
3bd79c7cd5
2 files changed
+10
-6
No files matched your search
+7
-5
@@ -198,17 +198,19 @@ static const char *test_match_prefix(void) {
|
||||
}
|
||||
|
||||
static const char *test_remove_double_dots() {
|
||||
struct { char before[20], after[20]; } data[] = {
|
||||
struct { char before[30], after[30]; } data[] = {
|
||||
{"////a", "/a"},
|
||||
{"/.....", "/."},
|
||||
{"/......", "/"},
|
||||
{"/.....", "/....."},
|
||||
{"/......", "/......"},
|
||||
{"...", "..."},
|
||||
{"/...///", "/./"},
|
||||
{"/...///", "/.../"},
|
||||
{"/a...///", "/a.../"},
|
||||
{"/.x", "/.x"},
|
||||
{"/\\", "/"},
|
||||
{"/a\\", "/a\\"},
|
||||
{"/a\\\\...", "/a\\."},
|
||||
{"/a\\\\...", "/a\\..."},
|
||||
{"foo/x..y/././y/../../..", "foo/x..y/y/"},
|
||||
{"foo/..x", "foo/..x"},
|
||||
};
|
||||
size_t i;
|
||||
|
||||
|
||||
Reference in new issue
Block a user