mirror of
https://github.com/rwf2/Rocket.git
synced 2025-01-08 10:42:37 +00:00
4bc5c20a45
In #134, @tunz discovered that Rocket does not properly prevent path traversal or local file inclusion attacks. The issue is caused by a failure to check for some dangerous characters after decoding. In this case, the path separator '/' was left as-is after decoding. As such, an attacker could construct a path with containing any number of `..%2f..` sequences to traverse the file system. This commit resolves the issue by ensuring that the decoded segment does not contains any `/` characters. It further hardens the `FromSegments` implementation by checking for additional risky characters: ':', '>', '<' as the last character, and '\' on Windows. This is in addition to the already present checks for '.' and '*' as the first character. The behavior for a failing check has also changed. Previously, Rocket would skip segments that contained illegal characters. In this commit, the implementation instead return an error. The `Error` type of the `PathBuf::FromSegment` implementations was changed to a new `SegmentError` type that indicates the condition that failed. Closes #134.
20 lines
418 B
Rust
20 lines
418 B
Rust
#![feature(plugin, custom_derive)]
|
|
#![plugin(rocket_codegen)]
|
|
|
|
extern crate rocket;
|
|
|
|
use std::path::PathBuf;
|
|
use rocket::http::uri::SegmentError;
|
|
|
|
#[post("/<a>/<b..>")]
|
|
fn get(a: String, b: PathBuf) -> String {
|
|
format!("{}/{}", a, b.to_string_lossy())
|
|
}
|
|
|
|
#[post("/<a>/<b..>")]
|
|
fn get2(a: String, b: Result<PathBuf, SegmentError>) -> String {
|
|
format!("{}/{}", a, b.unwrap().to_string_lossy())
|
|
}
|
|
|
|
fn main() { }
|