Fix dir traversal by percent-encoding dots

2024-06-14 11:58:06 +03:00
parent 9f7a6b58ce
commit 4b18320984
1 changed files with 6 additions and 0 deletions
--- a/common/network/websocket.c
+++ b/common/network/websocket.c
@@ -917,6 +917,12 @@ static void servefile(ws_ctx_t *ws_ctx, const char *in, const char * const user,

    percent_decode(path, buf, 1);

+    // in case they percent-encoded dots
+    if (strstr(buf, "../")) {
+        handler_msg("Attempted dir traversal attack, rejecting\n", len);
+        goto nope;
+    }
+
    handler_msg("Requested file '%s'\n", buf);
    sprintf(fullpath, "%s/%s", settings.httpdir, buf);