Attachment 28641 Details for Bug 64183

[patch] the patch for ".."

wget-LFS-20040909.CAN-2004-1487.dif (text/plain), 1.61 KB, created by Sebastian Krahmer on 2005-02-21 11:41:15 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Sebastian Krahmer

Created: 2005-02-21 11:41:15 UTC

Size: 1.61 KB

patch

obsolete

>diff -ruN wget-LFS-20040909/src/http.c wget-LFS-20040909.patched/src/http.c
>--- wget-LFS-20040909/src/http.c	2004-09-09 19:28:26.000000000 -0700
>+++ wget-LFS-20040909.patched/src/http.c	2005-02-21 04:13:05.000000000 -0800
>@@ -1719,6 +1719,7 @@
>   /* Open the local file.  */
>   if (!output_stream)
>     {
>+      sanitize_path(*hs->local_file);
>       mkalldirs (*hs->local_file);
>       if (opt.backups)
> 	rotate_backups (*hs->local_file);
>diff -ruN wget-LFS-20040909/src/utils.c wget-LFS-20040909.patched/src/utils.c
>--- wget-LFS-20040909/src/utils.c	2004-09-09 13:32:07.000000000 -0700
>+++ wget-LFS-20040909.patched/src/utils.c	2005-02-21 04:11:54.000000000 -0800
>@@ -368,6 +368,25 @@
> #endif
> }
> 
>+
>+char *
>+sanitize_path(char *path)
>+{
>+	char *str = NULL;
>+
>+	/* evilhost/../ */
>+	while ((str = strstr(path,  "..")) != NULL)
>+		memcpy(str, "__", 2);
>+	/* evilhost/.bashrc */
>+	while ((str = strstr(path, "/.")) != NULL)
>+		str[1] = '_';
>+	/* .bashrc */
>+	if (*path == '.')
>+		*path = '_';
>+	return path;
>+}
>+
>+
> /* Returns 0 if PATH is a directory, 1 otherwise (any kind of file).
>    Returns 0 on error.  */
> int
>diff -ruN wget-LFS-20040909/src/utils.h wget-LFS-20040909.patched/src/utils.h
>--- wget-LFS-20040909/src/utils.h	2004-09-09 21:05:36.000000000 -0700
>+++ wget-LFS-20040909.patched/src/utils.h	2005-02-21 04:04:07.000000000 -0800
>@@ -83,6 +83,7 @@
> int make_directory PARAMS ((const char *));
> char *unique_name PARAMS ((const char *, int));
> char *file_merge PARAMS ((const char *, const char *));
>+char *sanitize_path PARAMS ((char *));
> 
> int acceptable PARAMS ((const char *));
> int accdir PARAMS ((const char *s, enum accd));

Actions: View | Diff

Attachments on bug 64183: 28641 | 31702 | 33979