diff options
| author | Sriram Melkote <siri@couchbase.com> | 2012-12-15 04:03:45 +0530 |
|---|---|---|
| committer | Jan Lehnardt <jan@apache.org> | 2012-12-19 17:44:20 +0100 |
| commit | 6e749bf7e8f47ea59b9e22f23795ba081547fa0e (patch) | |
| tree | bcb065c540dd762a9abb9df012e00375bc640080 | |
| parent | 2b4ab67a951592c31cece2bb5dc0ea84d3099090 (diff) | |
| download | couchdb-6e749bf7e8f47ea59b9e22f23795ba081547fa0e.tar.gz | |
improve parsing of mochiweb relative paths
Patch adapted from http://www.couchbase.com/issues/browse/MB-7390
| -rw-r--r-- | src/mochiweb/mochiweb_util.erl | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/src/mochiweb/mochiweb_util.erl b/src/mochiweb/mochiweb_util.erl index 3b50fe7d8..6b8881894 100644 --- a/src/mochiweb/mochiweb_util.erl +++ b/src/mochiweb/mochiweb_util.erl @@ -68,11 +68,17 @@ partition2(_S, _Sep) -> %% @spec safe_relative_path(string()) -> string() | undefined %% @doc Return the reduced version of a relative path or undefined if it %% is not safe. safe relative paths can be joined with an absolute path -%% and will result in a subdirectory of the absolute path. +%% and will result in a subdirectory of the absolute path. Safe paths +%% never contain a backslash character. safe_relative_path("/" ++ _) -> undefined; safe_relative_path(P) -> - safe_relative_path(P, []). + case string:chr(P, $\\) of + 0 -> + safe_relative_path(P, []); + _ -> + undefined + end. safe_relative_path("", Acc) -> case Acc of @@ -809,6 +815,7 @@ safe_relative_path_test() -> undefined = safe_relative_path("../foo"), undefined = safe_relative_path("foo/../.."), undefined = safe_relative_path("foo//"), + undefined = safe_relative_path("foo\\bar"), ok. parse_qvalues_test() -> |