emo/busybox
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

httpd: don't drop/abuse QUERY_STRING when /cgi-bin/index.cgi is used

Browse Source 
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
This commit is contained in:
Denys Vlasenko
2011-12-19 12:30:34 +01:00
parent 93b4a60526
commit 03419aa037
2 changed files with 33 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
networking/httpd_indexcgi.c
View File

@ -221,20 +221,25 @@ int main(int argc, char *argv[])
unsigned long long size_total;
int odd;
DIR *dirp;
char *QUERY_STRING;
char *location;
QUERY_STRING = getenv("QUERY_STRING");
if (!QUERY_STRING
|| QUERY_STRING[0] != '/'
|| strstr(QUERY_STRING, "//")
|| strstr(QUERY_STRING, "/../")
|| strcmp(strrchr(QUERY_STRING, '/'), "/..") == 0
location = getenv("REQUEST_URI");
if (!location)
return 1;
/* drop URL arguments if any */
strchrnul(location, '?')[0] = '\0';
if (location[0] != '/'
|| strstr(location, "//")
|| strstr(location, "/../")
|| strcmp(strrchr(location, '/'), "/..") == 0
) {
return 1;
}
if (chdir("..")
|| (QUERY_STRING[1] && chdir(QUERY_STRING + 1))
|| (location[1] && chdir(location + 1))
) {
return 1;
}
@ -271,14 +276,14 @@ int main(int argc, char *argv[])
"\r\n" /* Mandatory empty line after headers */
"<html><head><title>Index of ");
/* Guard against directories with &, > etc */
fmt_html(QUERY_STRING);
fmt_html(location);
fmt_str(
"</title>\n"
STYLE_STR
"</head>" "\n"
"<body>" "\n"
"<h1>Index of ");
fmt_html(QUERY_STRING);
fmt_html(location);
fmt_str(
"</h1>" "\n"
"<table>" "\n"