Refactor static_validate_path

diff --git a/src/static.c b/src/static.c
index 429dd8e171eff5581fc6b60769588a8d246b5a30..fc682e06d3e98622c5d6c57bd064ac4284a44c2a 100644 (file)
--- a/src/static.c
+++ b/src/static.c
@@ -304,12 +304,28 @@ C_SIMPLE_HTTP_StaticFileInfo c_simple_http_get_file(
 
 int c_simple_http_static_validate_path(const char *path) {
   uint64_t length = strlen(path);
+
+  if (length >= 3 && path[0] == '.' && path[1] == '.' && path[2] == '/') {
+    // Starts with "..", invalid.
+    return 1;
+  }
+
   for (uint64_t idx = 0; idx <= length && path[idx] != 0; ++idx) {
-    if (length - idx >= 2) {
-      if (path[idx] == '.' && path[idx + 1] == '.') {
+    if (length - idx >= 4) {
+      if (path[idx] == '/'
+          && path[idx + 1] == '.'
+          && path[idx + 2] == '.'
+          && path[idx + 3] == '/') {
         // Contains "..", invalid.
         return 1;
       }
+    } else if (length - idx == 3) {
+      if (path[idx] == '/'
+          && path[idx + 1] == '.'
+          && path[idx + 2] == '.') {
+        // Ends with "..", invalid.
+        return 1;
+      }
     }
   }
   return 0;

diff --git a/src/test.c b/src/test.c
index 2f2b03e903f92e7aa446edec896fce544855721b..b2382b43a8fa97d9ff1c65c27d97a08a30584568 100644 (file)
--- a/src/test.c
+++ b/src/test.c
@@ -1004,6 +1004,11 @@ int main(int argc, char **argv) {
     CHECK_TRUE(info.result == STATIC_FILE_RESULT_OK);
     CHECK_STREQ(info.mime_type, "application/octet-stream");
     c_simple_http_cleanup_static_file_info(&info);
+
+    CHECK_TRUE(c_simple_http_static_validate_path("../derp") != 0);
+    CHECK_TRUE(c_simple_http_static_validate_path("./derp") == 0);
+    CHECK_TRUE(c_simple_http_static_validate_path("./../derp") != 0);
+    CHECK_TRUE(c_simple_http_static_validate_path("/derp/..") != 0);
   }
 
   RETURN()