From 8bcf0bf855c1cd7710aa6c04e8bf23c06248c88b Mon Sep 17 00:00:00 2001 From: Xavier Del Campo Romero Date: Tue, 20 Feb 2024 21:24:17 +0100 Subject: main.c: Improve relative path detection Otherwise, the following resources would be considered valid: - /user/../test - /user/./test - /user/a/. - /user/a/./test --- main.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/main.c b/main.c index a5adaaa..9bdfc58 100644 --- a/main.c +++ b/main.c @@ -395,16 +395,22 @@ static bool path_isrel(const char *const path) { if (!strcmp(path, "..") || !strcmp(path, ".") - || !strcmp(path, "./") - || !strcmp(path, "../") + || !strncmp(path, "./", strlen("./")) + || !strncmp(path, "../", strlen("../")) + || strstr(path, "/./") || strstr(path, "/../")) return true; - static const char suffix[] = "/.."; - const size_t n = strlen(path), sn = strlen(suffix); + static const char *const suffixes[] = {"/.", "/.."}; - if (n >= sn && !strcmp(path + n - sn, suffix)) - return true; + for (size_t i = 0; i < sizeof suffixes / sizeof *suffixes; i++) + { + const char *const suffix = suffixes[i]; + const size_t n = strlen(path), sn = strlen(suffix); + + if (n >= sn && !strcmp(path + n - sn, suffix)) + return true; + } return false; } -- cgit v1.2.3