couchdb-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From j..@apache.org
Subject [4/6] git commit: improve parsing of mochiweb relative paths
Date Wed, 19 Dec 2012 17:28:51 GMT
improve parsing of mochiweb relative paths

Patch adapted from http://www.couchbase.com/issues/browse/MB-7390


Project: http://git-wip-us.apache.org/repos/asf/couchdb/repo
Commit: http://git-wip-us.apache.org/repos/asf/couchdb/commit/bc5880f7
Tree: http://git-wip-us.apache.org/repos/asf/couchdb/tree/bc5880f7
Diff: http://git-wip-us.apache.org/repos/asf/couchdb/diff/bc5880f7

Branch: refs/heads/1.3.x
Commit: bc5880f7c342b79468bc66b6b1d34fcf5be83070
Parents: 6429a44
Author: Sriram Melkote <siri@couchbase.com>
Authored: Sat Dec 15 04:03:45 2012 +0530
Committer: Jan Lehnardt <jan@apache.org>
Committed: Wed Dec 19 17:45:07 2012 +0100

----------------------------------------------------------------------
 src/mochiweb/mochiweb_util.erl |   11 +++++++++--
 1 files changed, 9 insertions(+), 2 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/couchdb/blob/bc5880f7/src/mochiweb/mochiweb_util.erl
----------------------------------------------------------------------
diff --git a/src/mochiweb/mochiweb_util.erl b/src/mochiweb/mochiweb_util.erl
index 3b50fe7..6b88818 100644
--- a/src/mochiweb/mochiweb_util.erl
+++ b/src/mochiweb/mochiweb_util.erl
@@ -68,11 +68,17 @@ partition2(_S, _Sep) ->
 %% @spec safe_relative_path(string()) -> string() | undefined
 %% @doc Return the reduced version of a relative path or undefined if it
 %%      is not safe. safe relative paths can be joined with an absolute path
-%%      and will result in a subdirectory of the absolute path.
+%%      and will result in a subdirectory of the absolute path. Safe paths
+%%      never contain a backslash character.
 safe_relative_path("/" ++ _) ->
     undefined;
 safe_relative_path(P) ->
-    safe_relative_path(P, []).
+    case string:chr(P, $\\) of
+        0 ->
+           safe_relative_path(P, []);
+        _ ->
+           undefined
+    end.
 
 safe_relative_path("", Acc) ->
     case Acc of
@@ -809,6 +815,7 @@ safe_relative_path_test() ->
     undefined = safe_relative_path("../foo"),
     undefined = safe_relative_path("foo/../.."),
     undefined = safe_relative_path("foo//"),
+    undefined = safe_relative_path("foo\\bar"),
     ok.
 
 parse_qvalues_test() ->


Mime
View raw message