diff options
| author | shm <shm@NetBSD.org> | 2015-07-16 12:19:23 +0000 |
|---|---|---|
| committer | shm <shm@NetBSD.org> | 2015-07-16 12:19:23 +0000 |
| commit | efff4e1f3dc860631e847829913aebed4509f570 (patch) | |
| tree | 91b6146301a6b07b8baf06d069f36770efded155 /libexec/httpd | |
| parent | 4e77b92d0abb20695c868f523271551113c2281e (diff) | |
Fix handling path with multiple slashes at the beginning
Fix redirections escaping for user support
OK mrg@
Diffstat (limited to 'libexec/httpd')
| -rw-r--r-- | libexec/httpd/bozohttpd.c | 12 | ||||
| -rw-r--r-- | libexec/httpd/tilde-luzah-bozo.c | 19 |
2 files changed, 24 insertions, 7 deletions
diff --git a/libexec/httpd/bozohttpd.c b/libexec/httpd/bozohttpd.c index e2975339790..ac99fba8bd1 100644 --- a/libexec/httpd/bozohttpd.c +++ b/libexec/httpd/bozohttpd.c @@ -1,4 +1,4 @@ -/* $NetBSD: bozohttpd.c,v 1.65 2015/07/09 12:32:16 shm Exp $ */ +/* $NetBSD: bozohttpd.c,v 1.66 2015/07/16 12:19:23 shm Exp $ */ /* $eterna: bozohttpd.c,v 1.178 2011/11/18 09:21:15 mrg Exp $ */ @@ -895,8 +895,12 @@ bozo_escape_rfc3986(bozohttpd_t *httpd, const char *url) case ';': case '=': case '%': + case '\n': + case '\r': + case ' ': + case '"': encode_it: - snprintf(d, 4, "%%%2X", *s++); + snprintf(d, 4, "%%%02X", *s++); d += 3; len += 3; break; @@ -1332,6 +1336,10 @@ transform_request(bozo_httpreq_t *request, int *isindex) goto bad_done; } + /* omit additional slashes at the beginning */ + while (file[1] == '/') + file++; + switch(check_bzredirect(request)) { case -1: goto bad_done; diff --git a/libexec/httpd/tilde-luzah-bozo.c b/libexec/httpd/tilde-luzah-bozo.c index 7b272f1f1a2..f7fd0c7bd56 100644 --- a/libexec/httpd/tilde-luzah-bozo.c +++ b/libexec/httpd/tilde-luzah-bozo.c @@ -1,4 +1,4 @@ -/* $NetBSD: tilde-luzah-bozo.c,v 1.10 2014/01/02 08:21:38 mrg Exp $ */ +/* $NetBSD: tilde-luzah-bozo.c,v 1.11 2015/07/16 12:19:23 shm Exp $ */ /* $eterna: tilde-luzah-bozo.c,v 1.16 2011/11/18 09:21:15 mrg Exp $ */ @@ -36,6 +36,7 @@ #include <sys/param.h> +#include <assert.h> #include <errno.h> #include <pwd.h> #include <stdlib.h> @@ -58,20 +59,28 @@ int bozo_user_transform(bozo_httpreq_t *request, int *isindex) { bozohttpd_t *httpd = request->hr_httpd; - char c, *s, *file = NULL; + char c, *s, *file = NULL, *user; struct passwd *pw; *isindex = 0; - if ((s = strchr(request->hr_file + 2, '/')) != NULL) { + /* find username */ + user = strchr(request->hr_file + 2, '~'); + + /* this shouldn't happen, but "better paranoid than sorry" */ + assert(user != NULL); + + user++; + + if ((s = strchr(user, '/')) != NULL) { *s++ = '\0'; c = s[strlen(s)-1]; *isindex = (c == '/' || c == '\0'); } debug((httpd, DEBUG_OBESE, "looking for user %s", - request->hr_file + 2)); - pw = getpwnam(request->hr_file + 2); + user)); + pw = getpwnam(user); /* fix this up immediately */ if (s) s[-1] = '/'; |
