wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-29 11:57:32 +09:00
Code Issues Projects Releases Packages Wiki Activity

Add extra check for path traversal sanity v2.

Browse source
This commit is contained in:
Pale Moon 2018-03-18 10:37:51 +01:00 • committed by Roy Tam
commit 093e83da1a
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
chrome/nsChromeRegistry.cpp
View file

@ -234,15 +234,18 @@ nsChromeRegistry::Canonify(nsIURL* aChromeURL)
aChromeURL->SetPath(path); aChromeURL->SetPath(path);
} }
else { else {
// prevent directory traversals ("..")
// path is already unescaped once, but uris can get unescaped twice // path is already unescaped once, but uris can get unescaped twice
const char* pos = path.BeginReading(); const char* pos = path.BeginReading();
const char* end = path.EndReading(); const char* end = path.EndReading();
if (*pos == '/' || *pos == ' ') {
return NS_ERROR_DOM_BAD_URI;
}
while (pos < end) { while (pos < end) {
switch (*pos) { switch (*pos) {
case ':': case ':':
return NS_ERROR_DOM_BAD_URI; return NS_ERROR_DOM_BAD_URI;
case '.': case '.':
// prevent directory traversals ("..")
if (pos[1] == '.') if (pos[1] == '.')
return NS_ERROR_DOM_BAD_URI; return NS_ERROR_DOM_BAD_URI;
break; break;