Mailing-List: contact dev-help@cocoon.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cocoon.apache.org
From: "Carsten Ziegeler" <cziegeler@s-und-n.de>
To: <dev@cocoon.apache.org>
Subject: RE: cvs commit:
 cocoon-2.1/src/java/org/apache/cocoon/components/source/impl
 ContextSourceFactory.java
Date: Fri, 14 Nov 2003 15:11:24 +0100
Message-ID: <LKENJPKDAIKAPKHEOCMMAECLGDAA.cziegeler@s-und-n.de>
MIME-Version: 1.0
In-Reply-To: <3FB4DF8A.6050906@apache.org>
Importance: Normal
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset="us-ascii"

Sylvain Wallez wrote:
> 
> >           // Remove the protocol and the first '/'
> >  -        int pos = location.indexOf(":/");
> >  -        String path = location.substring(pos+1);
> >  +        final int pos = location.indexOf(":/");
> >  +        final String path = location.substring(pos+1);
> >  +        
> >  +        // fix for #24093, we don't give access to files 
> outside the context:
> >  +        if ( path.indexOf("../") != -1 ) {
> >  +            throw new MalformedURLException("Invalid path 
> ('../' is not allowed) : " + path);
> >  +        }
> >  
> >
> 
> Isn't this way of checking too strict? We can have perfectly valid cases 
> where one concatenates a base "context://foo/bar/" base URI with a 
> "../baz" relative path.
> 
Hmmm, who does such nice things?
Ok, but you're right - don't we have a URL mangler somewhere that does
this for us?

Carsten