do not allow / or .. in files requested by web clients
Costa Tsaousis (ktsaou) committed
Mar 23, 2014 at 05:13 UTC
4af1466edbec9de668ebfa51d7315a7dc50cb2f7
1 file changed
+6
netdata.c
+6
@@ -726,6 +726,12 @@ int mysendfile(struct web_client *w, char *filename)
726
{
727
debug(D_WEB_CLIENT, "%llu: Looking for file '%s'...", w->id, filename);
728
729
+ if(strstr(filename, "/") != 0 || strstr(filename, "..") != 0) {
730
+ debug(D_WEB_CLIENT_ACCESS, "%llu: File '%s' is not acceptable.", w->id, filename);
731
+ w->data->bytes = sprintf(w->data->buffer, "File '%s' is not acceptable. Filenames cannot contain / or ..", filename);
732
+ return 404;
733
+ }
734
+
735
// check if the file exists
736
struct stat stat;
737
if(lstat(filename, &stat) != 0) {