Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit0d1ebe0

Browse files
committed
Fix up canonicalize_path to do the right thing in all cases (I think ...
this was harder than it seemed at first glance). Also push code forchecking for ".." in file names into path.c where it belongs.
1 parent9cc5cae commit0d1ebe0

File tree

3 files changed

+91
-43
lines changed

3 files changed

+91
-43
lines changed

‎src/backend/utils/adt/genfile.c

Lines changed: 14 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
* Author: Andreas Pflug <pgadmin@pse-consulting.de>
1010
*
1111
* IDENTIFICATION
12-
* $PostgreSQL: pgsql/src/backend/utils/adt/genfile.c,v 1.2 2005/08/1218:23:54 tgl Exp $
12+
* $PostgreSQL: pgsql/src/backend/utils/adt/genfile.c,v 1.3 2005/08/1221:07:52 tgl Exp $
1313
*
1414
*-------------------------------------------------------------------------
1515
*/
@@ -46,33 +46,19 @@ typedef struct
4646
staticchar*
4747
check_and_make_absolute(text*arg)
4848
{
49-
intfilename_len=VARSIZE(arg)-VARHDRSZ;
50-
char*filename=palloc(filename_len+1);
49+
intinput_len=VARSIZE(arg)-VARHDRSZ;
50+
char*filename=palloc(input_len+1);
5151

52-
memcpy(filename,VARDATA(arg),filename_len);
53-
filename[filename_len]='\0';
54-
55-
canonicalize_path(filename);
56-
filename_len=strlen(filename);/* recompute */
57-
58-
/*
59-
*Prevent reference to the parent directory.
60-
*"..a.." is a valid file name though.
61-
*
62-
* XXX this is BROKEN because it fails to prevent "C:.." on Windows.
63-
* Need access to "skip_drive" functionality to do it right. (There
64-
* is no actual security hole because we'll prepend the DataDir below,
65-
* resulting in a just-plain-broken path, but we should give the right
66-
* error message instead.)
67-
*/
68-
if (strcmp(filename,"..")==0||/* whole */
69-
strncmp(filename,"../",3)==0||/* beginning */
70-
strstr(filename,"/../")!=NULL||/* middle */
71-
(filename_len >=3&&
72-
strcmp(filename+filename_len-3,"/..")==0))/* end */
73-
ereport(ERROR,
74-
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
75-
(errmsg("reference to parent directory (\"..\") not allowed"))));
52+
memcpy(filename,VARDATA(arg),input_len);
53+
filename[input_len]='\0';
54+
55+
canonicalize_path(filename);/* filename can change length here */
56+
57+
/* Disallow ".." in the path */
58+
if (path_contains_parent_reference(filename))
59+
ereport(ERROR,
60+
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
61+
(errmsg("reference to parent directory (\"..\") not allowed"))));
7662

7763
if (is_absolute_path(filename))
7864
{
@@ -90,7 +76,7 @@ check_and_make_absolute(text *arg)
9076
}
9177
else
9278
{
93-
char*absname=palloc(strlen(DataDir)+filename_len+2);
79+
char*absname=palloc(strlen(DataDir)+strlen(filename)+2);
9480
sprintf(absname,"%s/%s",DataDir,filename);
9581
pfree(filename);
9682
returnabsname;

‎src/include/port.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
* Portions Copyright (c) 1996-2005, PostgreSQL Global Development Group
77
* Portions Copyright (c) 1994, Regents of the University of California
88
*
9-
* $PostgreSQL: pgsql/src/include/port.h,v 1.80 2005/08/02 19:02:32 tgl Exp $
9+
* $PostgreSQL: pgsql/src/include/port.h,v 1.81 2005/08/12 21:07:52 tgl Exp $
1010
*
1111
*-------------------------------------------------------------------------
1212
*/
@@ -32,6 +32,7 @@ extern void join_path_components(char *ret_path,
3232
constchar*head,constchar*tail);
3333
externvoidcanonicalize_path(char*path);
3434
externvoidmake_native_path(char*path);
35+
externboolpath_contains_parent_reference(constchar*path);
3536
externconstchar*get_progname(constchar*argv0);
3637
externvoidget_share_path(constchar*my_exec_path,char*ret_path);
3738
externvoidget_etc_path(constchar*my_exec_path,char*ret_path);

‎src/port/path.c

Lines changed: 75 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $PostgreSQL: pgsql/src/port/path.c,v 1.56 2005/08/1219:43:32 momjian Exp $
11+
* $PostgreSQL: pgsql/src/port/path.c,v 1.57 2005/08/1221:07:53 tgl Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -225,7 +225,9 @@ void
225225
canonicalize_path(char*path)
226226
{
227227
char*p,*to_p;
228+
char*spath;
228229
boolwas_sep= false;
230+
intpending_strips;
229231

230232
#ifdefWIN32
231233
/*
@@ -277,30 +279,89 @@ canonicalize_path(char *path)
277279

278280
/*
279281
* Remove any trailing uses of "." and process ".." ourselves
282+
*
283+
* Note that "/../.." should reduce to just "/", while "../.." has to
284+
* be kept as-is. In the latter case we put back mistakenly trimmed
285+
* ".." components below. Also note that we want a Windows drive spec
286+
* to be visible to trim_directory(), but it's not part of the logic
287+
* that's looking at the name components; hence distinction between
288+
* path and spath.
280289
*/
290+
spath=skip_drive(path);
291+
pending_strips=0;
281292
for (;;)
282293
{
283-
intlen=strlen(path);
294+
intlen=strlen(spath);
284295

285-
if (len>2&&strcmp(path+len-2,"/.")==0)
296+
if (len >=2&&strcmp(spath+len-2,"/.")==0)
286297
trim_directory(path);
287-
/*
288-
*Process only a single trailing "..", and only if ".." does
289-
*not preceed it.
290-
*So, we only deal with "/usr/local/..", not with "/usr/local/../..".
291-
*We don't handle the even more complex cases, like
292-
*"usr/local/../../..".
293-
*/
294-
elseif (len>3&&strcmp(path+len-3,"/..")==0&&
295-
(len!=5||strcmp(path,"../..")!=0)&&
296-
(len<6||strcmp(path+len-6,"/../..")!=0))
298+
elseif (strcmp(spath,".")==0)
299+
{
300+
/* Want to leave "." alone, but "./.." has to become ".." */
301+
if (pending_strips>0)
302+
*spath='\0';
303+
break;
304+
}
305+
elseif ((len >=3&&strcmp(spath+len-3,"/..")==0)||
306+
strcmp(spath,"..")==0)
307+
{
308+
trim_directory(path);
309+
pending_strips++;
310+
}
311+
elseif (pending_strips>0&&*spath!='\0')
297312
{
313+
/* trim a regular directory name cancelled by ".." */
298314
trim_directory(path);
299-
trim_directory(path);/* remove directory above */
315+
pending_strips--;
316+
/* foo/.. should become ".", not empty */
317+
if (*spath=='\0')
318+
strcpy(spath,".");
300319
}
301320
else
302321
break;
303322
}
323+
324+
if (pending_strips>0)
325+
{
326+
/*
327+
* We could only get here if path is now totally empty (other than
328+
* a possible drive specifier on Windows).
329+
* We have to put back one or more ".."'s that we took off.
330+
*/
331+
while (--pending_strips>0)
332+
strcat(path,"../");
333+
strcat(path,"..");
334+
}
335+
}
336+
337+
/*
338+
* Detect whether a path contains any parent-directory references ("..")
339+
*
340+
* The input *must* have been put through canonicalize_path previously.
341+
*
342+
* This is a bit tricky because we mustn't be fooled by "..a.." (legal)
343+
* nor "C:.." (legal on Unix but not Windows).
344+
*/
345+
bool
346+
path_contains_parent_reference(constchar*path)
347+
{
348+
intpath_len;
349+
350+
path=skip_drive(path);/* C: shouldn't affect our conclusion */
351+
352+
path_len=strlen(path);
353+
354+
/*
355+
* ".." could be the whole path; otherwise, if it's present it must
356+
* be at the beginning, in the middle, or at the end.
357+
*/
358+
if (strcmp(path,"..")==0||
359+
strncmp(path,"../",3)==0||
360+
strstr(path,"/../")!=NULL||
361+
(path_len >=3&&strcmp(path+path_len-3,"/..")==0))
362+
return true;
363+
364+
return false;
304365
}
305366

306367

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp