stephenseo/c_simple_http
1
0
Fork 0
Code Issues Pull requests Projects Releases 5 Packages Wiki Activity Actions

Fix potential invalid path when fetching static

Browse source
This commit is contained in:
Stephen Seo 2024-11-03 17:54:55 +09:00
parent c77f8cdb96
commit a14355ac81
3 changed files with 23 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/main.c
View file

@ -452,6 +452,8 @@ int main(int argc, char **argv) {
response_code = C_SIMPLE_HTTP_Response_400_Bad_Request;
} else if (file_info.result == STATIC_FILE_RESULT_404NotFound) {
response_code = C_SIMPLE_HTTP_Response_404_Not_Found;
} else if (file_info.result == STATIC_FILE_RESULT_InvalidPath) {
response_code = C_SIMPLE_HTTP_Response_400_Bad_Request;
} else {
response_code = C_SIMPLE_HTTP_Response_500_Internal_Server_Error;
}

16
src/static.c
View file

@ -120,6 +120,9 @@ C_SIMPLE_HTTP_StaticFileInfo c_simple_http_get_file(
} else if (!ignore_mime_type && !c_simple_http_is_xdg_mime_available()) {
file_info.result = STATIC_FILE_RESULT_NoXDGMimeAvailable;
return file_info;
} else if (c_simple_http_static_validate_path(path) != 0) {
file_info.result = STATIC_FILE_RESULT_InvalidPath;
return file_info;
}
uint64_t buf_size = 128;
@ -298,4 +301,17 @@ C_SIMPLE_HTTP_StaticFileInfo c_simple_http_get_file(
return file_info;
}
int c_simple_http_static_validate_path(const char *path) {
uint64_t length = strlen(path);
for (uint64_t idx = 0; idx <= length && path[idx] != 0; ++idx) {
if (length - idx >= 2) {
if (path[idx] == '.' && path[idx + 1] == '.') {
// Contains "..", invalid.
return 1;
}
}
}
return 0;
}
// vim: et ts=2 sts=2 sw=2

6
src/static.h
View file

@ -26,7 +26,8 @@ typedef enum C_SIMPLE_HTTP_StaticFileResult {
STATIC_FILE_RESULT_InvalidParameter,
STATIC_FILE_RESULT_NoXDGMimeAvailable,
STATIC_FILE_RESULT_InternalError,
STATIC_FILE_RESULT_404NotFound
STATIC_FILE_RESULT_404NotFound,
STATIC_FILE_RESULT_InvalidPath
} C_SIMPLE_HTTP_StaticFileResult;
typedef struct C_SIMPLE_HTTP_StaticFileInfo {
@ -47,6 +48,9 @@ void c_simple_http_cleanup_static_file_info(
C_SIMPLE_HTTP_StaticFileInfo c_simple_http_get_file(
const char *static_dir, const char *path, int_fast8_t ignore_mime_type);
/// Returns zero if OK.
int c_simple_http_static_validate_path(const char *path);
#endif
// vim: et ts=2 sts=2 sw=2