mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-03 21:27:38 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

mod_http_files: Santize the path relative to our base URL before translating it to a filesystem path, fixes a relative path traversal vulnerability

Browse source
This commit is contained in:
Matthew Wild 2016-01-07 15:37:47 +00:00
parent 8a8f379272
commit cb1eeb2386
1 changed files with 33 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

34
plugins/mod_http_files.lua
View file

@ -49,6 +49,34 @@ if not mime_map then
end
end
local forbidden_chars_pattern = "[/%z]";
if prosody.platform == "windows" then
forbidden_chars_pattern = "[/%z\001-\031\127\"*:<>?|]"
end
local urldecode = require "util.http".urldecode;
function sanitize_path(path)
local out = {};
local c = 0;
for component in path:gmatch("([^/]+)") do
component = urldecode(component);
if component:find(forbidden_chars_pattern) then
return nil;
elseif component == ".." then
if c <= 0 then
return nil;
end
out[c] = nil;
c = c - 1;
elseif component ~= "." then
c = c + 1;
out[c] = component;
end
end
return "/"..table.concat(out, "/");
end
local cache = setmetatable({}, { __mode = "kv" }); -- Let the garbage collector have it if it wants to.
function serve(opts)
@ -60,7 +88,11 @@ function serve(opts)
local directory_index = opts.directory_index;
local function serve_file(event, path)
local request, response = event.request, event.response;
local orig_path = request.path;
path = sanitize_path(path);
if not path then
return 400;
end
local orig_path = sanitize_path(request.path);
local full_path = base_path .. (path and "/"..path or ""):gsub("/", path_sep);
local attr = stat(full_path:match("^.*[^\\/]")); -- Strip trailing path separator because Windows
if not attr then