wt/mongoose
1
0 Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2026-10-17 10:49:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

moved remove_double_dots_and_double_slashes() to string.c

Browse Source
This commit is contained in:
Sergey Lyubka committed 2013-11-23 07:46:11 +00:00
1 parent 0d2a8db626
commit 8c4521af03
3 files changed
+46 -46
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

build/src/mongoose.c
-23
View File
@@ -503,29 +503,6 @@ static int get_request_len(const char *buf, int buf_len) {
return 0;
}
// Protect against directory disclosure attack by removing '..',
// excessive '/' and '\' characters
static void remove_double_dots_and_double_slashes(char *s) {
char *p = s;
while (*s != '\0') {
*p++ = *s++;
if (s[-1] == '/' || s[-1] == '\\') {
// Skip all following slashes, backslashes and double-dots
while (s[0] != '\0') {
if (s[0] == '/' || s[0] == '\\') {
s++;
} else if (s[0] == '.' && s[1] == '.') {
s += 2;
} else {
break;
}
}
}
}
*p = '\0';
}
static const struct {
const char *extension;
size_t ext_len;
build/src/string.c
+23
View File
@@ -243,3 +243,26 @@ static int match_prefix(const char *pattern, int pattern_len, const char *str) {
return j;
}
// Protect against directory disclosure attack by removing '..',
// excessive '/' and '\' characters
static void remove_double_dots_and_double_slashes(char *s) {
char *p = s;
while (*s != '\0') {
*p++ = *s++;
if (s[-1] == '/' || s[-1] == '\\') {
// Skip all following slashes, backslashes and double-dots
while (s[0] != '\0') {
if (s[0] == '/' || s[0] == '\\') {
s++;
} else if (s[0] == '.' && s[1] == '.') {
s += 2;
} else {
break;
}
}
}
}
*p = '\0';
}
mongoose.c
+23 -23
View File
@@ -726,6 +726,29 @@ static int match_prefix(const char *pattern, int pattern_len, const char *str) {
return j;
}
// Protect against directory disclosure attack by removing '..',
// excessive '/' and '\' characters
static void remove_double_dots_and_double_slashes(char *s) {
char *p = s;
while (*s != '\0') {
*p++ = *s++;
if (s[-1] == '/' || s[-1] == '\\') {
// Skip all following slashes, backslashes and double-dots
while (s[0] != '\0') {
if (s[0] == '/' || s[0] == '\\') {
s++;
} else if (s[0] == '.' && s[1] == '.') {
s += 2;
} else {
break;
}
}
}
}
*p = '\0';
}
static const char *month_names[] = {
"Jan", "Feb", "Mar", "Apr", "May", "Jun",
@@ -2673,29 +2696,6 @@ static int get_request_len(const char *buf, int buf_len) {
return 0;
}
// Protect against directory disclosure attack by removing '..',
// excessive '/' and '\' characters
static void remove_double_dots_and_double_slashes(char *s) {
char *p = s;
while (*s != '\0') {
*p++ = *s++;
if (s[-1] == '/' || s[-1] == '\\') {
// Skip all following slashes, backslashes and double-dots
while (s[0] != '\0') {
if (s[0] == '/' || s[0] == '\\') {
s++;
} else if (s[0] == '.' && s[1] == '.') {
s += 2;
} else {
break;
}
}
}
}
*p = '\0';
}
static const struct {
const char *extension;
size_t ext_len;