diff options
| author | Dmitry Stogov <dmitry@php.net> | 2008-03-13 14:09:54 +0000 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@php.net> | 2008-03-13 14:09:54 +0000 |
| commit | 7705272218a81a4864e72b57e010cdc45a0802c5 (patch) | |
| tree | a0185eef2d3441146a8de2bfa1343d86c9033523 /main/fopen_wrappers.c | |
| parent | a9fe1010d2837cb2a02ef70156718603c3693cbd (diff) | |
| download | php-git-7705272218a81a4864e72b57e010cdc45a0802c5.tar.gz | |
Disable path resolution for filenames with stream wrappers
More careful check for relative pathes (./xxx and ../xxx)
Diffstat (limited to 'main/fopen_wrappers.c')
| -rw-r--r-- | main/fopen_wrappers.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/main/fopen_wrappers.c b/main/fopen_wrappers.c index 3fa92b121f..d686a303ac 100644 --- a/main/fopen_wrappers.c +++ b/main/fopen_wrappers.c @@ -446,13 +446,21 @@ PHPAPI char *php_resolve_path(const char *filename, int filename_length, const c { char resolved_path[MAXPATHLEN]; char trypath[MAXPATHLEN]; - char *ptr, *end; + const char *ptr, *end, *p; if (!filename) { return NULL; } - if (*filename == '.' || + /* Don't resolve patches which contain protocol */ + for (p = filename; isalnum((int)*p) || *p == '+' || *p == '-' || *p == '.'; p++); + if ((*p == ':') && (p - filename > 1) && (p[1] == '/') && (p[2] == '/')) { + return NULL; + } + + if ((*filename == '.' && + (IS_SLASH(filename[1]) || + ((filename[1] == '.') && IS_SLASH(filename[2])))) || IS_ABSOLUTE_PATH(filename, filename_length) || !path || !*path) { |