harden root_dir

mongoose.c

@@ -4484,13 +4484,15 @@ static void listdir(struct mg_connection *c, struct mg_http_message *hm,
 static bool uri2path(const char *r, struct mg_str uri, char *buf, size_t len) {
   struct mg_str k, v, part, s = mg_str(r), u = {NULL, 0}, d = u;
   size_t n;
+  bool matched = false;
   while (mg_span(s, &part, &s, ',')) {
     if (!mg_span(part, &k, &v, '=')) k = part, v = mg_str_n(NULL, 0);
     if (v.len == 0) v = k, k = mg_str("/"), u = k, d = v;
     if (uri.len < k.len) continue;
     if (mg_strcmp(k, mg_str_n(uri.buf, k.len)) != 0) continue;
-    u = k, d = v;
+    u = k, d = v, matched = true;
   }
+  if (!matched) return false;
   n = mg_snprintf(buf, len, "%.*s", (int) d.len, d.buf);
   if (len == 0 || n + 2 >= len) return false;  // Path overflow
   if (n > 0 && buf[n - 1] != '/') buf[n++] = '/', buf[n] = '\0';  // Add slash
@@ -9399,7 +9401,6 @@ static void rx_dhcp_client(struct mg_tcpip_if *ifp, struct pkt *pkt) {
                         : pkt->dhcp->siaddr ? pkt->dhcp->siaddr
                                             : pkt->ip->src);
     ifp->state = MG_TCPIP_STATE_REQ;  // REQUESTING state
-    ifp->lease_expire = ifp->now + 5000;  // No ACK by then: start over
   } else if (msgtype == 5) {          // DHCPACK
     if (ifp->state == MG_TCPIP_STATE_REQ && ip && gw && lease) {  // got an IP
       uint64_t rand;
@@ -10707,9 +10708,6 @@ static void mg_ip_poll(struct mg_tcpip_if *ifp, bool s1) {
   if (ifp->enable_dhcp_client && s1) {
     if (ifp->state == MG_TCPIP_STATE_UP) {
       tx_dhcp_discover(ifp);  // INIT (4.4.1)
-    } else if (ifp->state == MG_TCPIP_STATE_REQ &&
-               ifp->now >= ifp->lease_expire) {
-      ifp->state = MG_TCPIP_STATE_UP;  // REQUEST or ACK lost: DISCOVER again
     } else if (ifp->state == MG_TCPIP_STATE_READY &&
                ifp->lease_expire > 0) {  // BOUND / RENEWING / REBINDING
       if (ifp->now >= ifp->lease_expire) {

mongoose.h

@@ -4109,6 +4109,8 @@ struct mg_dash {
   struct mg_fs *upload_fs;  // FS for uploads/listing, default &mg_fs_posix
   // Resolves the built-in file manager's root dir for user u, e.g. per-user
   // upload directories. NULL: file manager disabled
+  // - The returned directory must be nonempty and must not contain ',' or '=',
+  // because it is used as an mg_http_serve_opts::root_dir mapping target.
   bool (*files_dir)(const struct mg_dash_user *u, char *buf, size_t len);
 };
 

src/dash.h

@@ -96,6 +96,8 @@ struct mg_dash {
   struct mg_fs *upload_fs;  // FS for uploads/listing, default &mg_fs_posix
   // Resolves the built-in file manager's root dir for user u, e.g. per-user
   // upload directories. NULL: file manager disabled
+  // - The returned directory must be nonempty and must not contain ',' or '=',
+  // because it is used as an mg_http_serve_opts::root_dir mapping target.
   bool (*files_dir)(const struct mg_dash_user *u, char *buf, size_t len);
 };
 

src/http.c

@@ -734,13 +734,15 @@ static void listdir(struct mg_connection *c, struct mg_http_message *hm,
 static bool uri2path(const char *r, struct mg_str uri, char *buf, size_t len) {
   struct mg_str k, v, part, s = mg_str(r), u = {NULL, 0}, d = u;
   size_t n;
+  bool matched = false;
   while (mg_span(s, &part, &s, ',')) {
     if (!mg_span(part, &k, &v, '=')) k = part, v = mg_str_n(NULL, 0);
     if (v.len == 0) v = k, k = mg_str("/"), u = k, d = v;
     if (uri.len < k.len) continue;
     if (mg_strcmp(k, mg_str_n(uri.buf, k.len)) != 0) continue;
-    u = k, d = v;
+    u = k, d = v, matched = true;
   }
+  if (!matched) return false;
   n = mg_snprintf(buf, len, "%.*s", (int) d.len, d.buf);
   if (len == 0 || n + 2 >= len) return false;  // Path overflow
   if (n > 0 && buf[n - 1] != '/') buf[n++] = '/', buf[n] = '\0';  // Add slash

src/net_builtin.c

@@ -734,7 +734,6 @@ static void rx_dhcp_client(struct mg_tcpip_if *ifp, struct pkt *pkt) {
                         : pkt->dhcp->siaddr ? pkt->dhcp->siaddr
                                             : pkt->ip->src);
     ifp->state = MG_TCPIP_STATE_REQ;  // REQUESTING state
-    ifp->lease_expire = ifp->now + 5000;  // No ACK by then: start over
   } else if (msgtype == 5) {          // DHCPACK
     if (ifp->state == MG_TCPIP_STATE_REQ && ip && gw && lease) {  // got an IP
       uint64_t rand;
@@ -2042,9 +2041,6 @@ static void mg_ip_poll(struct mg_tcpip_if *ifp, bool s1) {
   if (ifp->enable_dhcp_client && s1) {
     if (ifp->state == MG_TCPIP_STATE_UP) {
       tx_dhcp_discover(ifp);  // INIT (4.4.1)
-    } else if (ifp->state == MG_TCPIP_STATE_REQ &&
-               ifp->now >= ifp->lease_expire) {
-      ifp->state = MG_TCPIP_STATE_UP;  // REQUEST or ACK lost: DISCOVER again
     } else if (ifp->state == MG_TCPIP_STATE_READY &&
                ifp->lease_expire > 0) {  // BOUND / RENEWING / REBINDING
       if (ifp->now >= ifp->lease_expire) {

test/mip_test.c

@@ -80,10 +80,6 @@ static void test_statechange(void) {
   onstatechange(&iface);
   ASSERT(executed == true);
   executed = false;
-  iface.enable_dhcp_client = true;  // DHCP REQUEST unanswered: start over
-  iface.state = MG_TCPIP_STATE_REQ, iface.lease_expire = 0;
-  mg_ip_poll(&iface, true);
-  ASSERT(iface.state == MG_TCPIP_STATE_UP);
 }
 #if MG_ENABLE_IPV6
 static void mif6_fn(struct mg_tcpip_if *ifp, int ev, void *ev_data) {

test/unit_test.c

@@ -1475,6 +1475,11 @@ static void h4(struct mg_connection *c, int ev, void *ev_data) {
       opts.root_dir = "/a=./data";
       opts.page404 = "./data/404.html";  // existing 404 page
       mg_http_serve_dir(c, hm, &opts);
+    } else if (mg_match(hm->uri, mg_str("/unmapped"), NULL)) {
+      struct mg_http_serve_opts opts;
+      memset(&opts, 0, sizeof(opts));
+      opts.root_dir = "/a=./data";
+      mg_http_serve_dir(c, hm, &opts);
     } else if (mg_match(hm->uri, mg_str("/b/#"), NULL)) {
       struct mg_http_serve_opts opts;
       memset(&opts, 0, sizeof(opts));
@@ -1502,6 +1507,7 @@ static void test_http_404(void) {
   ASSERT(cmpbody(buf, "hello\n") == 0);
   ASSERT(fetch(&mgr, buf, url, "GET /a/a.txt HTTP/1.0\n\n") == 200);
   ASSERT(cmpbody(buf, "hello\n") == 0);
+  ASSERT(fetch(&mgr, buf, url, "GET /unmapped HTTP/1.0\n\n") == 400);
   ASSERT(fetch(&mgr, buf, url, "GET /b/a.txt HTTP/1.0\n\n") == 200);
   ASSERT(cmpbody(buf, "hello\n") == 0);