51 lines
1.8 KiB
Diff
51 lines
1.8 KiB
Diff
From d0fe86177427e0c3bc2cec1436d74472e4b618dd Mon Sep 17 00:00:00 2001
|
|
From: Muh Muhten <muh.muhten@gmail.com>
|
|
Date: Tue, 19 Feb 2019 00:35:40 -0500
|
|
Subject: [PATCH 5/9] Catch .. as the first component of a module path
|
|
|
|
Only the second and subsequent path components were being checked, which
|
|
I guess is theoretically security-relevant.
|
|
|
|
There's no apparent point to reconstructing the path after splitting it
|
|
by adding /s back in, either.
|
|
---
|
|
src/linker.c | 9 ++-------
|
|
1 file changed, 2 insertions(+), 7 deletions(-)
|
|
|
|
--- a/src/linker.c
|
|
+++ b/src/linker.c
|
|
@@ -98,12 +98,9 @@ static jv validate_relpath(jv name) {
|
|
return res;
|
|
}
|
|
jv components = jv_string_split(jv_copy(name), jv_string("/"));
|
|
- jv rp = jv_array_get(jv_copy(components), 0);
|
|
- components = jv_array_slice(components, 1, jv_array_length(jv_copy(components)));
|
|
jv_array_foreach(components, i, x) {
|
|
if (!strcmp(jv_string_value(x), "..")) {
|
|
jv_free(x);
|
|
- jv_free(rp);
|
|
jv_free(components);
|
|
jv res = jv_invalid_with_msg(jv_string_fmt("Relative paths to modules may not traverse to parent directories (%s)", s));
|
|
jv_free(name);
|
|
@@ -111,18 +108,16 @@ static jv validate_relpath(jv name) {
|
|
}
|
|
if (i > 0 && jv_equal(jv_copy(x), jv_array_get(jv_copy(components), i - 1))) {
|
|
jv_free(x);
|
|
- jv_free(rp);
|
|
jv_free(components);
|
|
jv res = jv_invalid_with_msg(jv_string_fmt("module names must not have equal consecutive components: %s",
|
|
jv_string_value(name)));
|
|
jv_free(name);
|
|
return res;
|
|
}
|
|
- rp = jv_string_concat(rp, jv_string_concat(jv_string("/"), x));
|
|
+ jv_free(x);
|
|
}
|
|
jv_free(components);
|
|
- jv_free(name);
|
|
- return rp;
|
|
+ return name;
|
|
}
|
|
|
|
// Assumes name has been validated
|